hackernews client

If IPv4 were land

325 pointsposted 4 days ago

by rokostik

(iptrust.co)

510 Comments

shubhamjain

4 days ago

India: 47M

China: 358M

Both countries have roughly the same population. The IPv4 problem has been swept under the rug with CGNAT and a normal person doesn't even notice it. But it sucks. Forget having a dedicated IP, even on a broadband connection, you don't get a public IP that's truly yours. According to IPInfo[1], there are around 1,000 users sharing my IP. I get flagged for malicious activity, and online gaming is impossible without a Tailscale relay.

Of course, much of this comes down to the bad luck (+ policies) of developing late, when most IPv4 blocks had already been allocated. But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks they'll probably never fully use, and may never sell. Meanwhile I am sharing a single public IP with a thousand strangers.

[1]: https://ipinfo.io/223.233.77.184

[2]: https://en.wikipedia.org/wiki/List_of_assigned_/8_IPv4_addre...

alibarber

4 days ago

PSA that if you have a ham radio licence, anywhere in the world, there are IPv4 addresses available for you for the taking at ARDC (AMPR)[1].

You can either get a block of /24 to announce yourself (you've got to cover all the technical setup and costs of this) or use their free 44net.connect service and just organise a wireguard tunnel.

You cannot use it for anything commercial.

[1] https://wiki.ampr.org/wiki/Main_Page

nextaccountic

3 days ago

Ok so I was looking at the market rates for ipv4, and it appears that $20 per IP is a common figure, which means that a /24 block is worth about $5000.. so, what's the catch? And how many /24 blocks does ARDC have available, really?

I'm most curious to understand why didn't bad actors gobble up all those /24 blocks already.

alibarber

3 days ago

You're absolutely correct - it's an incredibly valuable asset.

It's a really interesting piece of internet history. The whole 44.0.0.0/8 was assigned for loose 'amateur radio use' back in the 80s. For the most part it was used for building mesh networks over RF in different locations.

Then IP addresses became quite valuable. Now, I feel that what was really going to happen is that, with no real organisation around it, and not that much use of a very valuable asset, it would have been not unthinkable for the whole lot to have been taken away [by ARIN/ICANN/whoever] and assigned for general use. Certainly easier than taking it away from the US military. So, about a third of this space was sold to AWS and the money used to fund an actual organisation with staff - but mainly to issue grants to amateur radio projects around the world.

They therefore really do have [tens of thousands - sorry I don't remember how to calculate it right now] of /24s available. Internally - they allocate it how they want, some are only used on mesh networks, some are used for infra, some only private networks, but plenty for people to announce.

When they assign it to you, they're only giving you a Letter of Authorisation, and creating a route in a routing DB saying that your ASN is allowed to announce that allocation. They can withdraw that at any time which means the routes will be ignored by others.

Having the ham radio licence requirement is a reasonably accessible, yet robust entry barrier. The catch is you can't use the addresses for commercial purposes. They have staff and volunteers pretty much full time so if they find that they just cut you off.

An interesting parallel is the ham radio frequencies themselves. I love messing around with building equipment and transmitting, but actually getting an exclusive licence for a chunk of spectrum would cost me an impractical amount.

tcdent

4 days ago

I have looked into acquiring an ipv4 block many times but never came across this. Thanks for the lead!

aleph_minus_one

3 days ago

But in many countries (including Germany), you are not allowed to encrypt your transmissions via ham radio, e.g. using TLS with such IPv4 addresses is against the law.

alibarber

3 days ago

No that would only be if you were to use actual packet radio across the amateur bands with these. Some of them are used for that purpose indeed.

But the ones I’m referring too are just internet addresses you use on the public internet. Eg, ssh-ing to a raspberry pi, setting up an SDR, or just leaning BGP and suchlike.

kube-system

4 days ago

> But it's pretty unfair how US DoD, Apple, Ford, and others [1] are sitting on enormous IPv4 blocks

Maybe Apple and Ford, but it's more than fair that DoD has large blocks since they created ipv4 to connect themselves to other networks. It was only 10 years ago that the US government decided to give up control of IANA.

Mogzol

4 days ago

Sure there's historic reason that the DoD has such a large block, but it is definitely unfair in the modern world. There is no way they need or will ever use their massive block of addresses. They have 13 different /8 blocks, ~218 million unique addresses, that's over 5% of the entire IPv4 address space.

kube-system

4 days ago

IPv4 is old and broken, use IPv6.

malfist

4 days ago

I'd love to do that, if my ISP would provide me an IPv6 address. Windstream doesn't provide IPv6s. They did a trial a few years ago rolling it out and then undid it.

It's crazy I can get fiber to my house in the US, but not IPv6.

dijit

4 days ago

iirc, hurricane electric was offering IPv6 via tunnelling somehow.

https://tunnelbroker.net

I was doing this back when I had BT in London, my internet speed back then was pretty abysmal and it would randomly drop routes- ironically this tunnel actually improved my internet (because of the routes not being dropped, not the speed).

nucleardog

8 hours ago

Could vary depending on where your connection terminates, but last time I set this up the speed was abysmal.

I've got a 8Gbit symmetric fiber connection (with no IPv6 at all, yay) and regularly make use of all of it, so I'm well connected. Router hardware is more than capable of the encapsulation.

With the HE tunnel up, I was often getting tens of megabits per second for any endpoints that supported IPv6.

Works as a "this endpoint is _only_ available on IPv6" so I can connect to something I couldn't otherwise, but day-to-day the experience is vastly better over IPv4 for me.

cowlevel

4 days ago

They do this for free because they're a tier 1, meaning everyone pays to connect to them and they benefit from having more things hosted on their network. It's free because your ISP pays for it.

And they can always tell your ISP if they don't like paying to connect to the tunnelling server they should just implement v6.

toast0

4 days ago

"Intended" btw is not even an argument. Internet wasn't intended for many things which we happily do here.

spauldo

4 days ago

I'm well familiar with DynDNS. I used to run it before I got a real domain. It can't tell the difference between my laptop and my workstation, since they're both behind the same IP. I wasn't aware of iroh, but having looked it up, it's just a hack to get around problems that NAT has caused.

And yes, Dropbox does exist because of NAT, or more generally the fact that "consumers" are second-class citizens on the Internet. If everyone had a publicly routed address and an entry in DNS - which is how the Internet was originally envisioned - we'd have solutions that don't require a third party server.

Both of your examples just show how deep the Stockholm syndrome is. IPv4's limitations have shifted the way people think about networking so much that they rarely even realize they're doing it. But this isn't the way it was supposed to be. "Intended" is completely valid when we're talking about how something has strayed from its original design and the ramifications of it.

I'm not naive enough to think that we can ever get rid of the "consumer" and "producer" ideas that have crept into everyone's head. But it's important to remember that these ideas came about only because of limitations in the protocol, not because they're some kind of natural law of how global networks function.

kalleboo

4 days ago

> Search for iroh, or DynDNS for example

CG-NAT breaks all this. iroh relies on relays from people with non-broken internet (no CG-NAT).

broken-kebab

4 days ago

>iroh relies on relays

Yes, and DynDNS too. Which is fine, cause it works, and that is what I said. The claim to which it replies is that people have to pay to Dropbox cause poor souls were stopped from sharing files using existing technologies like FTP by the damned IPv4, and not because they simply prefer an out-of-the-box GUI thing.

kalleboo

4 days ago

There were out-of-the-box GUI experiences, like Apple's "Back to my Mac", that never worked right because of all the issues with poking through NAT caused by IPv4.

Relying on peer-to-peer relays also doesn't scale, which is why Skype dropped its supernode architecture.

user

4 days ago

[deleted]

wolrah

4 days ago

> That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

Dropbox gained popularity *BECAUSE IT MADE IT EASY TO DO THIS WHEN YOU'RE STUCK BEHIND NAT TRASH*. By the time it was even a thought in anyone's brain the internet had already been ruined by that garbage.

It would never have existed in a world without NAT because it wouldn't have been needed, syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

Every ISP that has CGNAT v4 without providing full v6 needs to be shut down. They are either incompetent or actively choosing to make their users' service less useful to restrict them and/or encourage "upgrades". Internet service has a public routable IP address, period.

broken-kebab

4 days ago

>it would never have existed in a world without NAT because it wouldn't have been needed,

I'm sorry, but this claim is one of the brightest examples of false consenses effect I've seen in ages. People generally just prefer an icon on desktop to click/tap. And that's the reason Dropbox found its audience.

spauldo

4 days ago

Now imagine if you didn't need that icon and Windows Explorer (or whatever file manager you use) could just connect to wherever your file is. Maybe through a "Favorite."

procaryote

4 days ago

Then imagine the security implications of trusting windows to serve just some selected files over FTP and never have any security hole that exposed other files or allowed RCE

spauldo

3 days ago

Yep. That's something we would have had to deal with. I would love to see what solution we would have come up with.

Sadly, we'll never know.

wolrah

3 days ago

You ignored the second half of that sentence:

> syncing data between computers you owned that all had publicly routable addresses is a much simpler problem.

In no way am I denying that people would like to solve the same problems easily. What I'm saying is that it would have been a much simpler problem requiring much less infrastructure. An application like SyncThing that works without any central infrastructure would have been an order of magnitude easier to implement in a world where every internet connected device had a unique routable address.

Gigachad

4 days ago

Only today we would have put everything behind something like NAT anyway because your devices would be getting hacked constantly.

wolrah

3 days ago

> Only today we would have put everything behind something like NAT anyway because your devices would be getting hacked constantly.

So the security "provided by" common 1:many NAT comes from the fact that 1:many NAT inherently requires stateful connection tracking and by its nature traffic coming in from the "1" side without an associated connection or rule has nowhere to go, effectively denying any other traffic by default from the "1" side which is almost universally the untrusted side.

Do you know what else has stateful connection tracking and deny-by-default rules on untrusted interfaces? Every single firewall that's worth using or even was at one point worth using in a year starting with a "2".

So yes, in a world without NAT we'd still have stateful firewalls blocking unsolicited incoming traffic that had not been specifically allowed. Those who wish to host public services will still need to configure rules to allow that traffic in unsolicited but those rules will be simpler than NAT port forwards because there's no address translation involved. Anything else wanting to generate on demand temporary connections between systems will be able to do so simply by having each system perform a basic hole punch, sending traffic at the other at the same time with the same pair of ports, and expect it to work again in ways much simpler than what's necessary for reliably doing the same in a 1:many NAT environment.

1:many NAT makes nothing better, it only makes things worse. It's a bad thing and needs to go away as quickly as possible.

---

1:1 NAT is an entirely different beast, it can be entirely stateless and thus has no has no negative impact on most protocols that don't try to communicate address info in-band but also that statelessness means it doesn't inherently provide a firewall effect.

locknitpicker

4 days ago

> It's slightly unrealic idea though, as most of internet users are consumers, and that's the role they really prefer. That's why Dropbox gained popularity in spite of, you know, the fact that we all can do it with FTP.

Dropbox gained popularity because none of us can or want to bother to do it with FTP, with the exception of a very small and determined minority.

Why do you think that even FANG engineers use cloud storage systems such as Dropbox/iCloud/OneDrive/Google Drive/etc. Can't an elite software engineer put together a FTP server?

Why do you think Dropbox et al are still a thing in spite of projects such as Syncthing?

This is not the only instance where user experience and convenience show their value. Look at Docker, for example. The "aktually" crowd will be fast to say that anyone can do the same with chroot et al, but they will again be missing the whole point. It's the same thing why Microsoft tried to invest in Aspire even though Docker is here.

It's like complaining that people can buy bread when all they need to make their own is flour, water, salt, and yeast. That's completely besides the point, ain't it?

spauldo

3 days ago

I think you're taking the "FTP" part a bit too literally here. No one's suggesting we'd jump in a terminal and type in FTP commands manually or even use the FTP protocol itself - we've got better options today, and we'd have even better options if the Internet had had global node-to-node connectivity all along.

It'd likely just be built into your operating system's tooling. Your file manager would be able to access other machines it can authenticate to, or you'd automount remote directories on login, etc.

The reason people use cloud storage systems for moving files around is because they have to. A 3rd party server is required because we don't have node-to-node connectivity.

Hell, we'd likely have had cloud storage options sooner because people wanting extra remote storage would totally have been a thing.

throw0101c

4 days ago

> You mean it's fixed by NAT and CGNAT. Because it's works just fine for me.

CGNAT works for you? Do you play video games at all? Because there are all sorts of people for which it doesn't.

The fact that you may be fortunate enough to get a publicly-accessible IPv4 address on your WAN interface does not mean everyone else is. This type of attitude seems to be akin to "I gots mine."

broken-kebab

4 days ago

I don't play this kind of games at all, but I still can sympathize with you if it's your preferred pastime, and it doesn't work as good as you'd like. I just don't think it warrants a conclusion that those nets in which we are arguing are broken. They are tangibly, observably doing pretty well. And I find that the idea that in a shiny world of pure IPv6 central servers/nodes would decentralize themselves comes from deep misunderstanding about what "normal" humans want.

throw0101c

3 days ago

> And I find that the idea that in a shiny world of pure IPv6 central servers/nodes would decentralize themselves comes from deep misunderstanding about what "normal" humans want.

It's not about "what 'normal' humans want", it's about what can even be built.

It's currently hard to build decentralized anything now, and it'd be nice to open things up to see what creative things (if any) people could come up with if the network allowed for more peer-to-peer connections.

Karrot_Kream

4 days ago

Until a service's WAF catches your /32 because your ISP had previously handed it out to a spammer.

broken-kebab

4 days ago

There are working procedures to follow in such situations, and minimally competent ISPs deal with them well enough so that most users don't even know the problem exists.

Karrot_Kream

3 days ago

Back when I managed teams that dealt with API traffic at a unicorn, this wasn't the case. We'd ban a /32 and several times customers would start reaching out to our support portal (which ran behind different ingress rules) asking why they couldn't use the site a couple weeks later.

I've never worked on the ISP side so there's no doubt that there is a process at the competent ones, but my guess is most users do not have a competent one.

4 days ago

A random ip address that is globally reachable?

Dagonfly

4 days ago

Why would it be reachable? It might be name-able but that doesn't imply reachable.

You're conflating the two parts of NAT: address translation and inbound filtering. A router can block any inbound traffic coming from WAN, even if the IPv6s on the LAN side are public.

In fact, hole punching for IPv4 shows this distinction. By default inbound traffic is blocked, but as soon as private host has opened up a connection, it is (indirectly) reachable and nameable (via the routers public IP + port).

BTW, static IPv4 NAT with public addresses on both sides exists as well.

asdf88990

3 days ago

Addressable means routable. Otherwise the distinction between a Public and Private address becomes one of firewall rules rather than a meaningful property of the IP Address.

And as you say, hole punching is still “PUBLIC IP” + port. Not an IP and any port you fancy unless the firewall was configured correctly.

Maybe I am wrong, maybe you’re confused, maybe IPv6 is just rubbish. Maybe all 3.

Dagonfly

3 days ago

You were asking about reachable, not routable. Of course, an address behind a firewall might be adressable and theoretically routable, but it certainly isn't reachable.

The default config of a SoHo router has both: (a) NAT44 separating public vs. private IPv4, (b) and also a firewall that blocks any unknown ingress traffic on IPv4 and IPv6.

From a security standpoint, it doesn't matter if the IP get translated inbetween. Only the ingress firewall counts: If the firewall is in-place both IPv4 and IPv6 traffic will be blocked. If you open up the firewall (via hole punching or port forwarding on IPv4, or via IP allows for IPv6), I can send packets to your public IPv4 + port and they will arrive at you private server, or I send them to your servers GUA IPv6 and it arrives. There is no security difference.

icedchai

3 days ago

The fact that the private IPv4 block is not globally reachable counts for something. If I accidentally give you my private IP (192.168.17.102, by the way!) you can't do anything, absent other details, no matter how much misconfiguration occurs. If I give you my IPv6 GUA, there's a lot more variability.

thayne

3 days ago

IPv6 has private blocks too. See https://en.wikipedia.org/wiki/Unique_local_address

asdf88990

3 days ago

I “inherently” reachable. You can play semantics but the point stands.

Karrot_Kream

4 days ago

There's more that's been written about configuring/protecting IPv4 networks and if you learn about network security from a mentor or from coworkers at a job, rather than reading books/the internet/LLMs, you're more likely to learn about IPv4 security.

tracert -6 google.com

I do get very different hops and latency.

However for “happy eyeballs” algo to fallback to IPv4, latency needs to be very bad on IPv6.

omansfeld

4 days ago

(I work on performance tuning a browsers happy eyeballs implementation)

Especially for DNS, browsers don’t wait “very long” for the AAAA (v6) record to be resolved when they already have the A record (v4) and will start the v4 connection after at max 50ms (iirc thats the spec value, but imo it is too long and most browsers wait less I think).

The good news is that if the AAAA still arrives later it will be cached, thus this only affects the first connection to a site.

As for the actual v6 connection being slower (lets say both A and AAAA come from cache) the browser will start a v6 connection and only fall back to v4 if the connection isn’t established within some time (I think the spec says 250ms).

And to make this all more complicated HTTP1/2/3 enter the decision matrix. I.e. should the browser rather try v4/http3 than v6/http2? Opinions probably differ.

All of this is also on the critical path to a website loading for the user, thats why all of those waits cannot be too long. At some point the benefit of the better protocol will be outweighed by waiting. Even worse if the website doesn’t support v6 and the wait was for nothing.

bombcar

4 days ago

Happy eyeballs is more to fix totally broke ipv6 than speed differential.

For many years and even how there are networks that advertise they can do ipv6 and hand out real addresses but nothing works.

nomel

3 days ago

Is this fundamentally from poor routing from infrequent use? For example, if usage was 50%, would the routing/hops between the two somewhat converge? Or is this actually a "v6 is hosted on a separate server somewhere else" type problem?

Dagger2

3 days ago

Google publish a per-country latency comparison[1]. Typically v6 is slightly faster. (Also, usage is in fact 50% on average.)

But in general, it's mostly because v4 and v6 can end up taking different routes. If an ISP has any BGP peers that are v4-only or v6-only then they can end up sending packets for the same host to different peers. In the worst cases, one of them can go to another country and back again. It's usually harder to get ISPs to fix this on v6 than it is on v4, because the problem is visible to fewer people (in part due to happy eyeballs itself).

For smaller websites, DNS caching can play a role. If there are fewer clients requesting AAAA records than there are clients requesting A records, there's a chance that a client requesting both will get a cached A record back quickly but have to wait for full resolution of the AAAA record. This is unlikely to happen for the most popular sites (because another client will probably have triggered the caching) or for the least popular sites (because the A record will also fall out of cache for those), but there'll be a band somewhere in the middle that's affected by this. There's enough v6-capable clients around these days that I doubt this has a major impact now, but it's interesting that caches can cause unfairness like this.

[1] https://www.google.co.uk/intl/en/ipv6/statistics.html#tab=pe...

lambdaone

4 days ago

I've got a buddy that's a technical manager at an ISP and he'll straight up tell you they don't do IPv6 because he and his people don't know it.

icedchai

4 days ago

Yep. I run into "enterprise" cloud environments where IPv6 is disabled, all the time. The sad thing is IPv6 is easier to understand than v4, just based on subnetting practices alone. The real problem is the average "IT" person doesn't understand hexadecimal.

procaryote

4 days ago

Thing is, you can run ipv4 only, dual stack or ipv6 only. Ipv6 only won't work. Dual stack has a larger attack surface and is complex. Ipv4 works but costs a relatively tiny bit of money so far.

Why would you not use ipv4?

giancarlostoro

3 days ago

At some point, you wont even own the IP, companies will haggle for which IPv4 port you "own" instead.

icedchai

3 days ago

Not for me. I'm a holder of a legacy IPv4 block.

unethical_ban

4 days ago

It's definitely a slight learning curve (a few days at most for basic understanding and troubleshooting). I can't speak to complexities like routing protocol configurations.

But goodness, the infinite-subnets-of-same-size glitch is so amazing. I see companies all the time that struggle to subnet their sprawling enterprise. Different subnet sizes everywhere, fragmented networks, subnet migrations to try to defragment, so on.

Many orgs are so short-staffed and staffed with mediocre talent that they spend their days fighting fires and keeping their flawed current practices operating just well enough to keep the lights on and not cause outages or security breaches. Things like "optimizations" and "redesigns" of the IP stack, even in 2026, would be a 5-10 year journey without a dollar sign benefit attached to it. So they limp along until the transition is seamless and necessary or monetarily desireable.

Dagonfly

4 days ago

It's only really a learning curve if you're an expert at IPv4, and try to apply your IPv4 mental model directly to IPv6.

toast0

4 days ago

Early bad experiences made a lot of people reluctant to try again.

There's a lot of edge cases to bite people still.

That said, something like 50% of users have working v6 now, which helps to file down the edges. Growth of v6 in the last 10 years has been much more significant than the previous 10 years. I suspect the next 10 years will be pretty significant, too.

3 days ago

4 days ago

That explains a lot of the sentiments I've seen on HN then...

I, unfortunately, have been on CGNATed residential internet since 2016, though I used to still get a public IP on request (they stopped doing that though.) I live in South East Asia, for context.

Without IPv6 my only choice would have been relying on a centralized service like Zerotier and Tailscale.

fishtacos

4 days ago

My current setup is CGNAT on 5G WAN (T-Mobile US), which obviously doesn't open public ports besides needed NAT.

Worse is I have IPv6 connectivity for devices, yet still no open ports available, so no serving available. And I only receive a /64 so no delegation available through router.

So now it's Hurricane Electric tunnel to their nearest (in my city) hosted node for IPv6 and a prepaid 50 USD/year node (technically x2 since I wanted a backup to play around with) for IPv4 port forwarding.

Both options are acceptable because the needed infra is close by in the largest metroplex in Texas, it just sucks to have to do all this extra work to replicate what I could do with a dial-up ISP.

I'll say this - having LLM assistants handle the nasty routing and firewall rules needed to make this hodge podge work without needing to be a network engineer has been very helpful.

toast0

4 days ago

If you're willing to jump through hoops, you might want to check if it's still possible to setup an EIN and a new SMB T-Mobile 5G internet and get a static ipv4 for a small charge per month.

Personally, I had major issues with the 5g wan equipment and my network as well as a snafu with ordering... Sales rep put in the order for a static ip with a ssn based SMB account, but that got removed during provisioning and couldn't be added back. (And then billing issues because the account didn't get cancelled properly, either)

myself248

4 days ago

I converted from residential-class to business-class cable a few years ago. In both cases, I had routable IPv4 addresses.

I was just looking at flipping back, but now it seems the default for new resi accounts is CGNAT. They say they'll give me a real IP upon request at no additional charge, but it's anyone's guess how long that holds out.

They don't do IPv6 at all.

Michigan USA.

sandos

4 days ago

In Sweden CGNAT was not a thing for a long time, the large incumbents still have their huge blocks of IPs so its "just" go to them if you want a pulic IP. Apparently smaller ISPs do use CGNAT, so its fairly common.

Me as somewhat of a nerd, even doubt if I need a public IP, seeing how cyber security is looking today.

4 days ago

End users do notice CGNAT when their internet voice/video calls keep dropping for no apparent reason.

lifeisloving

4 days ago

CGNAT is awesome, you cant IP ban me anymore and I dont need a VPN turned on for silly things, and I can control fingerprinting (mostly), CGNAT is great for anonymity. If I want a static it cost me ~10.00 a month, im fine with that.

oefrha

4 days ago

On the other hand, sometimes you get randomly banned due to someone else’s action on the CGNAT IP. Wikipedia is an obvious example.

lifeisloving

4 days ago

Thats the only site Ive encountered issues. Im okay with that. I dont think they just let anyone edit anymore anyways.

BenjiWiebe

2 days ago

You can actually have non-static non-CGNAT addresses.

That's even what you'd get with IPv6 by default.

xattt

4 days ago

Bell in Canada continues to offer only IPv4 on their fibre network. I fully expect for them to somehow crap up the transition to IPv6 by putting up CGNAT because fuck you, customer.

TheCycoONE

4 days ago

Fascinating. The resellers, particularly TechSavvy have ipv6. For TechSavvy I believe it was dynamic /64 by default but static /56 for free on request.

throw0101a

4 days ago

alibarber

4 days ago

On HN, 'In Europe' means in one person's particular locale based on their experience and generalised across a continent of about 30 countries. But it's always better than in the US of course.

efilife

4 days ago

Can we stop this europe/us fight? This remark was completely unwarranted

alibarber

4 days ago

I wrote this as a European (British) who is living in another European country (Finland). People happily write ‘in Europe’ whilst being quite selective in their definition of Europe - usually their very close neighbourhood, and it usually means North and Central Europe. If that.

IPv4 seems likely to remain in place for many existing applications, much like natural diamonds in jewelry, regardless of policy/advocacy views.

BirdieNZ

4 days ago

From a Georgist perspective, IPv4 is actually a form of land (it's a finite "natural resource", although that's not quite proper), and you could make a case for "land rent" being taxed on the addresses. This is the same as radio broadcast frequencies, web addresses, actual land, un-mined gold/oil/coal/whatever, and other finite natural resources that create monopolistic tendencies.

mort96

3 days ago

Wait do georgists describe any "finite natural resource" as "land"? Is clean drinking water "land"? Are radio frequencies "land"? Are domains "land"? (I mean domain names aren't "natural" but neither are IPv4 addresses????)

Weird-ass ideology

BirdieNZ

3 days ago

Georgists don't literally think that other scarce natural resources are actually land, but instead think that all scarce natural resources, if untaxed, lead to economic rents being extracted. Land/location ownership is probably the most damaging form of this, so it's the one that Henry George focused on, but the same basic principle applies to other natural resources.

This is why people refer to Norway's taxation of natural resource mining as "Georgist in principle" even though no land value tax is involved.

I (and I'm not original here) extrapolated that to other not-natural resources like IPv4 addresses, domain names, and so on that function much like a limited natural resource.

You even have cases of "land-banking" like nissan.com, although I don't believe Mr. Nissan ever intended to profit from owning the domain name; probably more akin to the main character of the movie Up.

mort96

3 days ago

Money is a scarce resource and should therefore be taxed.

You could say that it's intentionally kept scarce, and that is somewhat true, but currency is kept scarce because it only functions if it's scarce. Currency without scarcity ceases to be currency.

adverbly

3 days ago

The ideology is amazing.

The terminology is terrible.

But yes. When they say land they actually mean "natural resource".

The idea is that human-made resources should have their profits go to humans, but natural resources (most notably location value) do not belong to humans because humans did not make them, and also, the economic incentives normally associated with markets such as supply/demand management and price discovery don't apply because supply can't change.

Its extremely economically efficient and is endorsed by many economic thinkers on both the right and the left, as well as many social justice activists.

This is a decent recent video on the concept as it pertains to location value: https://www.youtube.com/watch?v=suiU5b9tmoE

mort96

3 days ago

Nah the ideology is just rich people or wannabe rich people wanting less taxes. Having a land value tax makes sense, removing all other taxes does not.

adverbly

3 days ago

No - it would have exactly the opposite effect.

4 days ago

Whereas IPv6 is effectively unlimited, so by Georgist principles should be free. I wonder if charging 'rent' on IPv4 addresses would be enough to get people to switch over?

port11

3 days ago

My hosting providers gives you IPv6 for free, whereas IPv4 costs ~3€/month. It seems like a no brainer, until you realise that many clients wouldn’t be able to find you with IPv6 alone.

So I don’t see how to fix this except at the ISP level (forcing them). No one is preventing this but the providers.

torvald

4 days ago

If you tax it, you get less of it.

perilunar

3 days ago

Yes, but 'use' rather than 'get'. If you tax land or other natural resources, people use less so there is more for everyone else. It doesn't pay to hoard or speculate.

TZubiri

4 days ago

>IPv4 is actually a form of land (it's a finite "natural resource", although that's not quite proper),

It's closer to radiofrequencies I think, these are heavily regulated.

However radiofrequencies are purely natural resources, while IPv4 have a specific copyrightable spec design, domains have trademarkable TLDs

derektank

4 days ago

Incidentally, auctions of time bounded licenses, which are what we use to allocate frequency spectrum, have the same theoretical pareto efficiency as a value tax.

adverbly

3 days ago

Surely that would assume low/predictable volatility thought right?

If the probability changes over time that the price might go up and back down for a 6 month period which is bounded inside of a single auction-able period, then the auction would not have ever captured it correctly... Low frequency auctions assumes perfect risk prediction which isn't realistic and comes with large insurance and analysis overheads.

andix

4 days ago

IPv6 got some real traction in the last decade. From around 10% adoption up to 50%. It's not dead, like many are claiming. It works fine, just keep implementing it.

throw0101c

4 days ago

> From around 10% adoption up to 50%.

akho

3 days ago

Thank you. It's been a while since that paper was published )

I was interested in the number for Russia; 2 out of 4 mobile networks do not provide ipv6, and wired network ipv6 availability depends on provider; provider-supplied routers generally disable ipv6 anyway. So the 78% seems high.

Could be that this is measured from youtube; people use vpns to go there, and those typically have ipv6. That would mean that country is tracked by account, not source ip.

akho

3 days ago

(apparently, the same page showed 9% for Russia in early 2025, so, yeah, low trust)

usui

4 days ago

I keep IPv4 off on a media computer all the time out of curiosity. IPv6-only is still unusable because only about 5% to 10% of top sites that I find during a Google Search work. It's almost guaranteed that a website will not load on all the top results.

So even if it's true 50% of clients support IPv6, only about 5% to 10% of website hosts do.

Sure a person can do a dual-stack setup or do some IPv4-IPv6 translation, but seriously IPv6-only should be plug-and-play by now.

andix

4 days ago

Cloud providers and hosters seem to have the least interest in implementing IPv6. Sitting on a huge supply of IPv4 addresses gives them a competitive advantage. So they try to disable IPv6 as a default.

cowlevel

4 days ago

That's very surprising. Cloudflare supports ipv6 and it would be surprising if only 10% of websites you visit use Cloudflare.

andix

4 days ago

I guess a lot of sites just turn it off. Even if Cloudflare proxies it over IPv4 the IPv6 source address still shows up in server logs. Features like geolocating users or fraud prevention might need additional work for IPv6.

simoncion

4 days ago

> ...IPv6-only should be plug-and-play by now.

The obsession about "IPv6 only" has never made sense to me. Any decent firewall software will let you write rules that apply regardless of IP version. The "software complexity" argument is bunk... you already have v4 and v6 IP implementations in your OS, and every major OS has provided IP-version-agnostic socket interface code for much more than ten years. If you are using software that is IPv6-capable, it's very likely that it's using IP version agnostic library functions.

Unless stewardship of the Internet is wrested from the hands of the responsible, level-headed type of folks that run it now and transferred to the hands of folks who think nothing of making backwards-incompatible changes every six months, IPv4 won't stop running across the Internet within the lifetime of anyone who's currently reading HN. This delay is fine. The only thing about IPv4 that's a problem is that its address space is 32 bits wide. Had it been defined with a 128+ bit address space, we wouldn't have seen another version of IP on the Internet. Now that IPv6 is around to reduce address pressure, there's no big need to do anything about IPv4.

ebiederm

4 days ago

I believe the folks worrying about IPv6 only are just looking ahead to a possible future. Especially when they are looking at the question of do all the pieces work locally, vs do popular domains support it.

There are domains like T-mobile US that are IPv6 only already. T-mobile runs NAT in the network so that all of IPv4 is NAT'd to IPv6.

I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.

Once IPv6 becomes the choice to support to get new customers, it is reasonable to expect that IPv4 support will start deteriorating and will eventually fade away.

I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.

simoncion

4 days ago

> I believe the folks worrying about IPv6 only are just looking ahead to a possible future.

I'm certain that that is not what the folks who scream very loudly about how IPv6 has been and continues to be a colossal failure because it's not the only version of IP on the Internet are doing.

> I do think it is reasonable to expect there will become a time when IPv6 is pervasive enough, that new deployments will target users with IPv6 rather than IPv4.

Sure. That's the future I find most plausible: For "residential" connections, provide IPv6 GUAs and IPv4 via CGN... [0] for "commercial" connections, provide IPV6 GUAs and give the customer the option of one or more IPv4 GUAs.

> I will be very surprised if we don't hit that tipping point in my lifetime. Say the next 30 years.

I do hope we get to that point within the next five years, if not ten! But notice that my claim is that IPv4 will still be crossing the Internet after everyone reading HN today is dead. [1]

[0] I'm calling the various mechanisms that only provide an IPv6 address to an end user and do fancy gyrations to provide IPv4 access "CGN", even if might not strictly be CGN.

[1] ...as long as the the responsible, level-headed type of folks that run it now aren't replaced with the "making backwards-incompatible changes to everything every six months is A-OK!" type of folks.

spauldo

4 days ago

I can totally understand why. IP addresses are hard to get for a large chunk of the global population. There's twice as many people as there are IP addresses.

Plus dual-stack means more work, and more possibilities for misconfigurations or vulnerabilities in your network. It'd be way easier if you only had to worry about one or the other.

I live in the US and my ISP gives me one address I have to share across all the machines in my house. That's a tragedy - by all rights I should have a subnet or two. You can't directly address any of my servers from the outside on IPv4 which means I have to do hacky crap like port forwarding and can't use a lot of the older protocols that aren't NAT friendly. And I've got it good compared to most of the world!

IPv6 gives us back a large chunk of the original premise of the Internet - that all nodes are peers. IPv4 hasn't been able to do that for decades, and it's warped the way we think about networking by separating everyone into consumers and providers.

simoncion

4 days ago

> Plus dual-stack means more work, and more possibilities for misconfigurations or vulnerabilities in your network.

Nope. Your OS vendor already did the work to make both versions of IP work. And as I mentioned, if you're using a decent firewall you can write IP-version-agnostic rules just as easily as you can ones that depend on the version.

Plus, most SOHO firewalls default to dropping unsolicited non-ICMP traffic. That's the exact same security stance that IPv4 + NAT gives you. You have to go out of your way (or be using fancy gear that is aimed at people who know what they're doing) to expose your LAN hosts.

spauldo

4 days ago

My OS vendor didn't set up my firewall rules, lay out my subnets, or configure my routing. I did that. Twice. Because I've got a slightly more advanced network layout than your typical home user. And that's all much less complicated that what your typical corporate network would be, which is much less complicated than what an ISP or COLO provider has to deal with. And then there's the cloud...

Yeah, sure, if your requirements can be met by a cable modem, then you're basically good to go. Until DNS breaks for some machines and not others, and it's because your ISP screwed something in their IPv6 routing but it still works on IPv4. Or Microsoft's authentication servers decide they don't like your IPv6 subnet anymore and Minecraft refuses to start unless you turn IPv6 off. Or... You get the idea.

simoncion

4 days ago

> My OS vendor didn't set up my firewall rules, lay out my subnets, or configure my routing. I did that.

Wow! Me too!

> Because I've got a slightly more advanced network layout than your typical home user.

Mine's quite a bit more advanced, if we're being frank. Though, the way I have things set up should be the default for SOHO stuff. This sort of configuration really is something whose setup can be automated, but never will be for as long as dumbswitches are the go to for SOHO equipment.

Anyway. I guess you and I just have dramatically different opinions on what's difficult. ;)

spauldo

4 days ago

Possibly. Or maybe you and I did a dramatically different amount of work on our networks. My setup is very much not what should be default for SOHO, for instance.

My point wasn't ever about home users anyway.

simoncion

2 days ago

> My setup is very much not what should be default for SOHO, for instance.

I'd be interested in hearing about it. I expect that you and I disagree pretty strongly on what should be the default. As one example, it's my opinion that -for WiFi clients- RADIUS authentication should be the default, with a PSK SSID as a backup for crappy WiFi devices that don't support it.

> My point wasn't ever about home users anyway.

I reckon that your point applies equally well to the ideal home user setup and Enterprise configurations.

idatum

4 days ago

And Windows 11 now supports CLAT.

commandersaki

4 days ago

But it's not really useful until it has critical mass at say 80 or 90%.

cyberax

4 days ago

IPv6 is dead. Nobody cares about it.

I will believe otherwise once even one US hotel chain supports it. I have _never_ seen a hotel in the US with IPv6 WiFi. Not once.

And I once stayed in a hotel (in Mountain View, CA) that gave out public IPv4 addresses.

Sesse__

4 days ago

Last time I was in a California hotel, it had IPv6 just fine. That was 2012. Perhaps you choose the wrong hotels :-)

throw0101a

4 days ago

> IPv6 is dead. Nobody cares about it.

Except for everyone on T-Mobile US:

* https://www.youtube.com/watch?v=d6oBCYHzrTA

Or all of FaceMeta's internal infrastructure:

* https://engineering.fb.com/2017/01/17/production-engineering...

Or 86% of France:

* https://www.google.com/intl/en/ipv6/statistics.html#tab=per-...

kccqzy

3 days ago

You should try staying at small boutique hotels. They tend to just sign up for a regular business internet and you’ll get IPv6 that way. Large chain hotels want central management and their management isn’t modern enough to support v6.

andix

4 days ago

Okay, if you say so. Hotel Wifis are known for being on the bleeding edge of technology, and as the main innovator pushing new internet technology. Everything starts with hotel Wifis. /s

cyberax

4 days ago

Exactly my point. IPv6 failed to reach the "boring, just works" level after 30 years of deployment. So much so that we are now deploying solutions with 10+ years of expected service lifetime that do not support IPv6.

Meanwhile, CGNAT really solved most issues with IPv4. Yes, even the voice/video chat issues.

Want another fun example? Try to find a SIP telephony provider in the US that supports IPv6. Go on. I do this exercise about once a year.

simoncion

4 days ago

> IPv6 failed to reach the "boring, just works" level after 30 years of deployment.

/me glances over at my phone, which only has an IPv6 address when connected via cellular modem.

/me thinks back to the decade+ of incredibly boring IPv6 service from the residential ISPs I've used.

Sure.

If an ISP wants to provide only IPv6 addresses to CPE, they can set things up so that happens. But if you won't be satisfied until IPv4 no longer passes over the Internet, then you're going to die unhappy about that. The goal for our lifetime is one where every residential site has a global /56 and is behind IPv4 CGN, and servers hosted by commercial entities get to choose whether they assign IPv4 addresses, IPv6 addresses, or both to their servers.

TobTobXX

4 days ago

/me searching through all the mobile network providers in Switzerland (a technologically advanced country) and not finding any.

Seriously, this drives me mad. There is NO WAY to get IPv6 on mobile networks in Switzerland. Neither Swisscom, nor Sunrise, nor Salt, and of course no reseller.

And Android handles this particularly poorly. I have some servers set up in my tailscale network on private IPv6 addresses, but android doesn't query AAAA addresses if it has no ::/0 route, so I HAVE to route all my traffic through my VPN which often creates other complications (with corporate wifi etc.)

4 days ago

> ...and didn't where it doesn't matter yet.

Given the number of scaredy-ass ISPs out there who refuse to offer IPv6 service, I disagree with this. But I do strongly agree with the rest of your comment.

I also very strongly assert that claims of the form "IPv6 is not the only version of IP used on the Internet, therefor it is a complete failure." maybe with a side of "And this 'failure' means that IPv6 is a dead protocol." are just plain stupid. v4 and v6 were very deliberately designed to coexist, and if v4 continues to run on the Internet until the day the Internet is shut down, that's totally fine.

Whoops. The printing is now broken somehow. Why?

simoncion

4 days ago

> Prefix withdrawal doesn't work reliably on Android.

Works fine on the Android hardware I have. Are you attempting to retire prefixes that have an infinite lifetime? That doesn't work, and I don't think it's supposed to work.

> Neither does this solution allow for load balancing...

As I said

  Or are you talking about load balancing, which is its own thing? Either way, this situation is inherently *not* boring, so the way you solve it is going to be quite a bit more complex -regardless of IP protocol version- than the very boring single-upstream situation.

> Printers get an RFC1918 address and don't care about global connectivity.

Okay, so why are you complaining about your printer being broken by GUAs that you're not permitting it to have? ;)

> IPv6 is nothing like IPv4 operationally.

For anyone who's not an IP stack developer, network hardware developer, or Enterprise sysadmin it absolutely is. And other than the fact that every endpoint is able to get a global address in v6, the sysadmin-visible differences between v4 and v6 are minor. RAs instead of... well, nothing, and DHCP for both.

> Whoops. The printing is now broken somehow. Why?

Exactly.

Why isn't your DHCPv6 server putting either both the GUA and ULA, or -better- only the ULA addresses in your LAN's DNS server? This Just Works™ on dnsmasq, which is one of the most widely-deployed DNS+DHCP servers on SoHo gear. [0] dnsmasq's default TTL for hosts added to the DHCP lease file appears to be 0, so -worst case- your sleepy computer tries to continue its conversation with the printer a couple of times, does ND and discovers that the IP it was using is gone, then looks up the hostname again and gets the new address of the printer. I think the trendy term for this back in the 2000s was "self-healing".

If you're going to retort "But we don't use dnsmasq in the companies I'm sometimes talking about!"... well, if you can't figure out how to not register upstream-controlled GUA addresses for your LAN hosts in your DNS, then do what dnsmasq does and serve them up with a TTL of 0.

[0] To head off the "Android doesn't really do DHCPv6" retort: Even though Android refuses to use anything other than DHCPv6-PD for managed address assignment, -AFAIK- Android still sends DHCPv6 ADDR_REG_INFORM messages for addresses it autogenerates on networks with either the "OtherConfig" or "Managed" flags set. I haven't bothered to set up my Linux systems to do this, but I'd be surprised if Windows and Darwin systems didn't do this.

cyberax

4 days ago

> Why isn't your DHCPv6 server putting either both the GUA and ULA, or -better- only the ULA addresses in your LAN's DNS server?

I don't have a LAN's DNS server or a DHCPv6. BTW, I have had an IPv6-only home network for 10 years, with NAT64 and 464XLAT.

You still haven't solved my puzzle or even understood what's happening. The current source address selection rules result in hosts prefering a GUA address pair over ULA. This _will_ result in broken connectivity when GUA addresses change.

There is currently no standards-compliant way to solve my challenge, except getting an ASN, an IPv6 assignment, and announcing it through your uplinks. Which I've also done in my home network, btw.

There's an in-progress RFC to change this, by preferring ULA-ULA address pairs over GUA-GUA. So it might be usable some time in the 2030-s ( https://www.ietf.org/archive/id/draft-ietf-6man-rfc6724-upda... ).

And no, this is not a theoretic problem. It affects protocols like SIP or even mDNS that exchange the IP addresses. They will consistently prefer unstable GUAs over ULAs.

simoncion

4 days ago

> I don't have a LAN's DNS server or a DHCPv6.

Yeah, that's why you think that this is a "puzzle".

Though, it does invalidate every complaint you've made about IP source address priority. The only ways you'll get multiple addresses for a given host are to either hard-code them, or use DNS [0]. Given that you're not using DNS, then you either have automation to update all those hard-coded configs, or you do it all by hand. Either way, you're deliberately recording addresses that you don't control for your LAN hosts, and considering it a "puzzle" when you have trouble reaching those LAN hosts when your upstream provider changes their address.

[0] Given that every resolver I've ever used pulls data from '/etc/hosts', I'm considering that to be part of DNS for the purposes of this conversation. I'm also considering Avahi and friends to be DNS. [1]

[1] And if you've talked to any long-term Avahi user, you've certainly heard about its habit of -on daemon or host restart- erroneously considering host name of the machine it's running on to be "in use" and appending a "-N" to the end of it. The remarkable eagerness of Avahi to engage this collision-avoidance mechanism makes it entirely unsuitable for discovery of LAN hosts whose hostname is actually important. This fact breaks my heart, but Avahi has been doing this shit for a very, very long time, so it's probably never going to get fixed.

cyberax

4 days ago

> The only ways you'll get multiple addresses for a given host are to either hard-code them, or use DNS

mDNS exists. As does SIP and SMB.

I first discovered the ULA/GUA issue when my TimeMachine backup dropped mid-session when I was testing Internet connection failover. Apple later fixed it by allowing multiple SMB sessions in parallel and preferring IPv4 connections. I have a pure IPv6-only network, as I said.

The same issue happens with SIP, as phones send their own addresses during the media connection negotiation.

(I have another funny story about SIP: Asterisk used to send a Cartesian product of available codecs and IP addresses, so if you had IPv6 privacy addresses on, it eventually accumulated enough of them to overflow the MTU, causing connections to silently drop)

simoncion

4 days ago

> I first discovered the ULA/GUA issue...

Check out my research on this issue. [0] The results might surprise you.

[0] <https://news.ycombinator.com/item?id=50299152>

andix

4 days ago

> Use ULAs

Isn't that the default for modern routers? They just generate a random ULA during setup and assign it.

Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps. Everyone setting up their LAN on 192.168.0.x makes it quite a mess on IPv4.

simoncion

4 days ago

> Isn't that the default for modern routers?

I assumed so because it's the obviously correct thing to do, but I haven't used a SoHo router in so many years, so I don't know.

> Random ULAs are also great for LAN-to-LAN VPNs, because there aren't any private IP overlaps.

Yep! Extremely low chance of prefix collision is their most important purpose. I've been part of several corporate acquisitions, and it inevitably took 6->18+ months to do enough of the IPv4 renumbering and server-discommissioning [0] process to begin to merge the LANs of the merging companies. Had they used ULA addressing, the odds of having to do that massive amount of work would be effectively zero.

And if collisions aren't something you give any shits about, nothing stops you [1] from setting your ULA to fd00::/48 and advertising fd00::/64 on your LAN for static IP addresses that are notably shorter than you can get with IPv4!

[0] ...because there's so little space in the 1918 range...

4 days ago

The problem is real. In IP discovery GUA is prioritized over ULA. And if the GUA goes away or changes regularly it leads to connectivity issues.

ULA work well in combination with DNS though.

simoncion

4 days ago

> In IP discovery GUA is prioritized over ULA. And if the GUA goes away or changes regularly it leads to connectivity issues.

Sure, but you're generally not going to get both addresses associated with a single host unless you either hard-code them or use DNS. For any non-stupid network, source address selection for reaching LAN hosts doesn't really matter. And for many-to-most SOHO networks, you're going to be running dnsmasq, which will quickly set you right after any GUA change.

And like, the thing to be noticing here is that source address selection priorities for both IPv4 and IPv6 seem to give us the same actual behavior. Consider a pair of hostnames served up by BIND 9 and some applications running on bog-standard Gentoo Linux whose '/etc/gai.conf' contains only comments and blank lines:

  # getent ahosts dumbhost.invalid
  1.1.1.1         STREAM dumbhost.invalid
  1.1.1.1         DGRAM  
  1.1.1.1         RAW    
  192.168.30.30    STREAM 
  192.168.30.30    DGRAM  
  192.168.30.30    RAW    
  # ping -n -c1 dumbhost.invalid
  PING dumbhost.invalid (192.168.30.30) 56(84) bytes of data.
  From <redacted> icmp_seq=1 Destination Host Unreachable

  --- dumbhost.invalid ping statistics ---
  1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms

  # curl -v dumbhost.invalid
  * Host dumbhost.invalid:80 was resolved.
  * IPv6: (none)
  * IPv4: 192.168.30.30, 1.1.1.1
  *   Trying 192.168.30.30:80...
  * connect to 192.168.30.30 port 80 from <redacted> port 47140 failed: No route to host
  *   Trying 1.1.1.1:80...
  * Established connection to dumbhost.invalid (1.1.1.1 port 80) from <redacted> port <redacted>
  <snip>
  # getent ahosts dumbhost6.invalid
  fd00::1         STREAM dumbhost6.invalid
  fd00::1         DGRAM  
  fd00::1         RAW    
  2002:db8::1     STREAM 
  2002:db8::1     DGRAM  
  2002:db8::1     RAW
  # ping -n -c1 dumbhost6.invalid
  PING dumbhost6.invalid (fd00::1) 56 data bytes
  From <redacted> icmp_seq=1 Destination unreachable: No route
  
  --- dumbhost6.invalid ping statistics ---
  1 packets transmitted, 0 received, +1 errors, 100% packet loss, time 0ms

  # curl -v dumbhost6.invalid
  *   Trying [fd00::1]:80...
  * connect to fd00::1 port 80 from <redacted> port <redacted> failed: Network is unreachable
  *   Trying [2002:db8::1]:80...
  * Host dumbhost6.invalid:80 was resolved.
  * IPv6: fd00::1, 2002:db8::1
  * IPv4: (none)
  ^C
  # ip addrlabel list | sort -hk 4
  prefix ::1/128 label 0 
  prefix ::/0 label 1 
  prefix 2002::/16 label 2 
  prefix ::/96 label 3 
  prefix ::ffff:0.0.0.0/96 label 4 
  prefix fc00::/7 label 5 
  prefix 2001::/32 label 6 
  prefix 2001:10::/28 label 7 
  prefix fec0::/10 label 11 
  prefix 3ffe::/16 label 12

Notice how actual application behavior doesn't match what folks in this thread are saying that source address selection dictates. Android behaves the same way, and -weirdly- my OpenWRT hosts have the exact opposite behavior and prefer using global addresses to ULA or 1918 ones, regardless of IP protocol version.

Anyway. If he put both IPv4 GUAs and 1918 addresses in DNS or his '/etc/hosts', he'd be having the same problem he's complaining about here... depending on -I guess- the OS he's using and how his resolver treats the ordering of entires in '/etc/hosts'.

This isn't an IPv6 problem, this is a "Things break for a little while when I use addresses to communicate with a host that can change out from under me instead of addresses that I control and those addresses happen to change." problem.

> ULA work well in combination with DNS though.

Yep! Most everything works great with DNS. Remembering IP addresses is for the birds.

simoncion

4 days ago

  2002:db8::1

Ah, so this is in the range assigned to 6to4 (2002::/16). Both Windows 10 and Android seem to treat it specially, [0] but Linux does not. So, I changed the AAAA record to 2400:db8::1 and re-ran my tests. I found out:

The 'getent ahosts' output remains unchanged.

When dealing with IPv4, all Linuxes, Android, and Windows 10 intermittently switch between preferring the GUA or the 1918 address. I seem to have gotten unbelievably (un?)lucky when testing v4 on Android, Gentoo Linux, and OpenWRT the first go around.

When dealing with IPv6, Android and Windows 10 always preferred the v6 GUA to the ULA. Every Linux I tried -and I tried several, each from different distros, some with and some without systemd, spread across years of releases- always preferred the ULA to it... except for OpenWRT, which always preferred the GUA. The only way I could get OpenWRT to prefer the ULA was to remove its GUA address but keep its v6 default route in place. Odd behavior. I wish I had a Steam Deck to see if "prefer the GUA" is something that appliance vendors tend to do, or if it's just a dubious OpenWRT customization.

The IPv6 behavior of all the OSs I tested is far better than the v4 behavior... predictability is always good. But it is remarkable that even many years ago, Linux was doing the sane thing for v6 address selection, while its commercial cousins and competitors -apparently- hadn't [1] bothered to think through how best to arrange things for "residential" users.

[0] ...even when no 6to4 addresses are configured on the host!

[1] ...and still haven't...

kstrauser

4 days ago

> The 50% stat is really mostly mobile phones on cellular networks, which remain the _only_ major success story for IPv6.

The largest ISPs in the US are Comcast, AT&T, Charter, Verizon, T-Mobile, Starlink, and Google Fiber. They all support IPv6. The only top-10 US provide that didn't support it is Frontier Communications, who is rolling it out.

In other words, the biggest companies who actually do this for a living all demonstrate that you're wrong.

As to your questions, read up on IPv6 ULA which solves all of them. None of the hosts on my LAN depend on having an outbound connection.

andix

4 days ago

> For context: I deployed IPv6 in my networks in 2006. I have war stories.

Early IPv6 was a mess. It took a surprising amount of time for IPv6 to become mature and usable.

cyberax

4 days ago

I'd argue that it's still not mature. ULA/GUA mess is one example, I recommend reading this delightful thread with beer and popcorn: https://mailarchive.ietf.org/arch/msg/v6ops/7-SuigPyP0R-C6ZC...

Having to waste 64 bits for the local part of the address is another one. There's an RFC in progress to allow neighbor discovery with shorter prefixes, so we might be able to use it by 2045.

And Android _still_ doesn't support DHCPv6.

inglor_cz

4 days ago

This is quite similar situation indeed. It was once easier to adopt the metric system when the infrastructure was not yet as developed around the previous ones.

Austria-Hungary adopted the metric system in the 1870s. Back then: no cars, no highways, no speeding laws etc. Oxen-drawn wagons in the countryside were not built to a precise spec.

Only the railway, the architects and the artillery had to really switch. Ordinary people would still ask the grocer for half a pound of ham in the 1930s.

USA in the 1970s would have to remeasure all the land communications etc., or end up with a weird hybrid like the UK.

WHat we have in IPv4 and IPv6 is the weird UK-like hybrid...

throw0101c

4 days ago

Australia managed to do a complete† change over starting in the 1970s:

* https://en.wikipedia.org/wiki/Metrication_in_Australia

It's going to take decades, mostly waiting for the non-metric folks to die off probably and the raised-on-metric folks to grow up, but if you don't start you'll never finish.

† Can Aussie HNer confirm?

KnightHawk3

4 days ago

I'm Australian and the only things measured in imperial units is babies (stones? But I think younger parents now use metric, but my parents only know baby weights in stones), beer (pints, but not the same as overseas I think, also it can vary by state), certain types of land units ("acerage" is a common land plot size) and height (feet and inches, for some reason people don't understand it in metric)

These are all customary usage so I'd say we are completely switched over, we couldn't tell you generally what these units look like outside of "how big is a baby" or "how tall is that person" or "is my beer large or small" really.

spauldo

4 days ago

AFAIK you all use imperial pints, which are a little bigger than the ones used in countries that still use the customary system (US and I assume Liberia). I'm pretty sure your pints are the same as those used in the rest of the commonwealth, but corrections are welcome.

That goes back to the fact that the imperial system replaced the older customary system after the American revolution. The US legislated a somewhat simplified version of the Customary System the English were using at the time, which was a piecemeal system based on several different acts of parliament over hundreds of years. We (much) later made slight changes so that our measurements are based on metric.

The Imperial System was instituted in the UK in 1826 and most of the measurements stayed the same, which is why our foot and pound are the same as your foot and pound. The biggest change was that imperial simplified the various liquid measurements to make them uniform. Before then, different liquids used different measurements. The gallon used in the US was originally based on the wine gallon whose value had been last set by parliament in 1709.

Symbiote

4 days ago

Babies would be measured in pounds and ounces, as they weigh roughly ½ stone at birth.

poncho_romero

4 days ago

Canada also changed over in the 1970s. I was told as a kid that the US had planned to switch with us but backed out at the last minute. I'm not sure if that's true or not. Today, the imperial system holds on in a few places, like heights and weights of people (although not at the hospital) and cooking temperatures.

throw0101c

4 days ago

> Today, the imperial system holds on in a few places, like heights and weights of people (although not at the hospital) and cooking temperatures.

Construction: "two-bys" are used, with 16/19.2/24" offsets for studs and such (though the building code has millimetre equivalents).

mahboi

4 days ago

IPv4 is better than IPv6, and imperial is better than metric. I would like something to replace IPv4, but that thing shouldn't be IPv6 and probably won't be at this rate.

cowlevel

4 days ago

How are they better?

woah

4 days ago

IPv6 has a huge amount of bloat created by guys in cargo shorts and pony tails being flown out to exotic locales 3x a year for IETF conferences to argue about minutia and try to get their name on some IPv6 spec document. All they needed to do was add a couple more dots onto IPv4 and maybe switch to hex.

throw0101a

4 days ago

> All they needed to do was add a couple more dots onto IPv4 and maybe switch to hex.

There is no 'just' extending the address length:

      So it's a matter of mathematical and physical fact that to expand
      the address size, you must change the protocol, and that means 
      [three] things immediately:

            You have to change the version number.

            You have to add new code to handle the new version.

      […]

            You need a coexistence technique so that updated systems, 
            with the new protocol, can connect to old systems that know 
            nothing of the new protocol.

      Two minutes of thought show that this third requirement has only 
      two solutions:

            (3A) Dual stack, in which the new machines speak both 
                 the old (IPv4) and new (IPng) protocol.

            (3B) Translation, in which something translates addresses
                 between the old and new protocols.

* https://github.com/becarpenter/misc/blob/main/why6why.md

* https://datatracker.ietf.org/doc/html/rfc1671

You also have to update DNS to create new resource record types ("A" is hard-coded to 32-bits) to support the new longer addresses, and have all user-land code start asking for, using, and understanding the new record replies. Just like with IPv6. (A lot of legacy code did not have room in data structures for multiple reply types: sure you'd get the "A" but unless you updated the code to get the "A+" address (for "IPv4+" addresses) you could never get to the longer with address… just like IPv6 needed code updates to recognize AAAA, otherwise you were A-only.)

In any 'address extension' plan the legacy code cannot use the new address space; you have to:

* update the IP stack (like with IPv6)

* tell applications about new DNS records (like IPv6)

* set up translation layers for legacy-only code that cannot be update to reach extended-address-only destination (like IPv6 with DNS64/NAT64, CLAT, etc)

Dagger2

4 days ago

3 days ago

Nobody's stopping you from using DHCP and NAT on IPv6, it's just not the norm.

> For example, the global IPv4 address 192.0.2.4 has the corresponding 6to4 prefix 2002:c000:0204::/48. This gives a prefix length of 48 bits, which leaves room for a 16-bit subnet field and 64 bit host addresses within the subnets.

* https://en.wikipedia.org/wiki/6to4

And the 'old' IPv4 addresses are available in the new IPv6 world:

> Addresses in this group consist of an 80-bit prefix of zeros, the next 16 bits are ones, and the remaining, least-significant 32 bits contain the IPv4 address. For example, ::ffff:192.0.2.128 represents the IPv4 address 192.0.2.128. A previous format, called "IPv4-compatible IPv6 address", was ::192.0.2.128; however, this method is deprecated.[5]

* https://en.wikipedia.org/wiki/IPv6#IPv4-mapped_IPv6_addresse...

There is no way around this limitation: you must have a separate network space because of physical limitations.

Your supposed solution, and many others, have been thought of already. Have been tried. You are not thinking of anything new in your proposal.

mahboi

4 days ago

6to4 and NAT64 are not what I'm saying. Those involve a relay server and v4 translation, and there's an entire memo on why that's unreliable and abandoned. I want to switch to fully native IPv6 without changing any of my addresses. There's no reason this should be impossible.

throw0101a

3 days ago

> I want to switch to fully native IPv6 without changing any of my addresses. There's no reason this should be impossible.

… except for the fact that you have to have completely new data structures and packet format to fit more address bits, and once you change the structures you need a new version field so any gear that sees a packet knows where to use the old code paths or new ones.

Then you're at the point where you have to push new code everywhere to handle these changes, and some nodes will have only the old code and some the new code, so now you're into translation and/or tunnelling to make sure the old addresses can talk to new addresses. Depending on their risk tolerance, some operators will enable the new code and some will not.

You also have to update DNS with new records, as A records are hard-coded to 32 bits. So now you're updating DNS libraries and user land.

There is no way to expand address space without going through all the same issues as what we call "IPv6" (originally SIPP) has gone through.

* https://github.com/becarpenter/misc/blob/main/why6why.md

mahboi

3 days ago

I know. All these things were possible and completed for IPv6, but that's only part of the battle. The rest is making it easy for users at various levels to migrate. IPv6 didn't do that, that's why we're stuck in today's situation.

IPv6 added an unnecessary requirement to change all existing routes, which is huge. If still using old v4 addrs in v6, there should be no need to change DNS yet. You shouldn't need a different DNS or DHCP server, only one that supports both protocols (also shouldn't be forced to use SLAAC). V6 translation to/from v4 should be doable at any hop instead of relying on a flaky anycast relay. The later stage of migration should just be that people start using longer addresses given that both ends are v6 and DNS etc supports it then. Even still there should be no requirement for every hop along the route to be v6, only the ones that go deeper than /32 near the ends. But we got all these extra constraints because of ipv6 design decisions.

Dagger2

3 days ago

But v6 did most of what you're asking for there??

It has "IPv4-compatible IPv6 address"es: https://datatracker.ietf.org/doc/html/rfc2373#section-2.5.4, and then a way to get them over networks where not every hop supports v6: https://datatracker.ietf.org/doc/html/rfc2893#section-5. You don't need new DNS or DHCP to use these, or SLAAC. There's no anycast relay. They can go over v4 hops.

Why spend all this energy complaining about v6 not doing something that it did do?

4 days ago

As a Canadian I have no idea what 72˚F means or feels like: is it warm or cold? I do know what 22˚C feels like and how to dress for it. How "intuitive" a temperature number is completely learned behaviour and cultural acclimation.

Pounds vs kg: see above. All the non-American people seem to have "intuitive" grasp of metric measurements.

> 0-100 MPH lines up well with car speeds, which is usually the thing you're measuring with that. KPH is excessively granular for that. Probably not by design, but yeah.

So 'more granularity' is good for temperature but not for speed. Got it.

> The feet/inches vs meters/cm thing matters less. It's base-12 vs base-10. You can do decimal feet or fractional meters of course, but it's less common, so apparently both ways are fine.

By "foot" do you mean 'regular' foot or survey foot:

* https://www.nist.gov/pml/us-surveyfoot

Because there are two different units in the US customary system, used for basically the same purpose, that use the same name. And the "foot" isn't the only unit like that:

* https://en.wikipedia.org/wiki/Pound_(mass)

* https://en.wikipedia.org/wiki/Pound_(force)

Here's another one: which weighs more, a pound of feathers or a pound of gold? A pound of feathers. Because feathers use one 'pound-system' [1] and is 453g, while gold uses another pound-system [2] and is 373g. But of course an "ounce" of gold (31g) is more than an "ounce" of feathers (28g), because Troy is 1/12 of pound but Avoirdupois is 1/16. In addition to the above "ounces" there is also "fluid ounces".

[1] https://en.wikipedia.org/wiki/Avoirdupois

[2] https://en.wikipedia.org/wiki/Troy_weight

mahboi

4 days ago

I didn't say it's about being used to one. It can be "in the 20s" C for multiple months, kinda silly. 22.0˚C also feels different from 22.5˚C. There's a right amount of granularity for temperature and for speed.

Foot and pound have unambiguous meanings in the US. There's a reason the whole survey foot and gold-pound thing is trivia that nobody knows, they're niche or abandoned systems that you only use if you're being clear that it's not regular feet or pounds. I also know that the US system is technically not "imperial," but nobody cares.

spauldo

4 days ago

I'm not the person you were replying to, but I can answer this one. And yeah, I can see all the metric fanboys (a very small subset of metric users, mind you) hovering over that downvote button, but I don't get paid in Internet points so here goes:

The nice thing about imperial (as well as the customary system used in the US) is that it's based on measurements that people have found useful over thousands of years. They're human units, adapted to what people need to do with them, not the other way around.

It's difficult to explain to metric folks because it's really something you have to experience. But here's an example:

Reservoir volume in the US is measured in acre-inches. An acre is a unit of area used for measuring property, usually farmland. It's a bit less than half of a hectare. And of course an inch is 2.4cm. Acre-inches sounds totally bizarre when you first hear about it. But for the people that need to work with this value, it's an extremely useful way to measure reservoirs and gives you an intuition that you just don't get from cubic meters.

It's true that you can't just convert that to other units of volume without doing some math or looking up the conversion rate, but that rarely matters. If you're trying to figure out how fast the lake will rise or fall with a given inflow and outflow, you're going to have to have some way to account for the fact that the lake is a) an irregular shape and b) takes up more area the higher the water gets. You already need to know the area of the lake at any particular height to work out the evaporation rate anyway, so that's a number you're going to have. The units are designed to make that calculation easier, which was really important back in the days when slide rules were the state of the art.

All the customary units are like this in one way or another. They're units designed for a particular domain, and when used in their domain they work very well and calculations can be done in your head. They use fractions because that's what people have historically used (seriously - my grandfather could work fractions in his head faster than I could type them into a calculator, and he made asphalt for a living. Imagine what a carpenter could do.).

Think about it. Imagine you were never taught a measurement system. You find yourself needing to come up with a unit to make measurements for wooden planks you're going to use to build a house. Would you choose a unit as long as a meter? Or one as short as a centimeter or even a decimeter?

Bonus challenge to the fine folks clicking that downvote button: give me a real practical reason to prefer Celsius to Fahrenheit, besides the fact that Celsius is part of the metric system. No, the freezing and boiling points of water don't cut it - I work with hydrocarbon fuels, I salt my driveway and patio, I don't live at sea level, and quite honestly every American 8-year-old can spout off 32° and 212°. There's a Fahrenheit equivalent to Kelvin (Rankine) so the Kelvin to Celsius equivalence doesn't count either. My claim is that both scales are completely arbitrary, and only advantage one has over the other is that you're used to one of them. Go ahead, prove me wrong!

perilunar

4 days ago

> Reservoir volume in the US is measured in acre-inches.

Never heard of an acre-inch before, and I'd have to get out a calculator to work out how much water that actually is in pints or gallons, or how much it weighs.

The metric equivalent would be a hectare-meter or a hectare-mm. I know a hectare is 100 m x 100 m, so 10,000 m². So I instantly know that a hectare-meter is 10,000 m³ (10 ML, or 10,000 tonnes of fresh water). A hectare-mm is 10 m³ (10 kL). If my 1 ha block gets 1 mm of rain, then that's 10 kL or 10 tonnes of water. So easy i can do it in my head.

> And of course an inch is 2.4cm

2.54 cm.

spauldo

3 days ago

> Never heard of an acre-inch before

I only know of it because it's a unit used by the US Army Corps of Engineers, who maintain the local reservoir. A buddy of mine's dad worked for them when I was a kid so that lake was my stomping ground.

> 2.54 cm

Oops! You're right! My bad.

Root_Denied

4 days ago

A couple more to add to your list: an inch is about as long as your thumb joint (with some variation between individuals obviously). It's an easy way to gauge the size of everyday objects without needing to carry around a tape measure.

The recommendation for emergency supplies is about a gallon of water per person per day - or 3.7 liters if you're using metric.

I've also heard it claimed that the 0-100 Fahrenheit scale is more functionally useful because the endpoints of 0 and 100 represent the tipping point of serious danger for humans from hot or cold weather. The closer you get to 100 degrees the more care you need to take about heat stroke and keeping hydrated, and similarly the closer you get to 0 degrees the more care you need to take about retaining heat and staying out of the elements - the freezing and boiling point of water isn't a necessary marker for survival. And people like nice round numbers to serve as markers for such things, divisibility be damned.

Metric is sterile and functional for calculation and consistency, which is fine and necessary for many things, but that's not a reason to completely ditch Imperial.

throw0101a

4 days ago

> The nice thing about imperial (as well as the customary system used in the US) is that it's based on measurements that people have found useful over thousands of years. They're human units, adapted to what people need to do with them, not the other way around.

US customary is not "thousands" of years; temperature (Fahrenheit) only came out in 1724 for example, and many other units were only standardize much more recently:

* https://en.wikipedia.org/wiki/History_of_measurement#History...

* https://en.wikipedia.org/wiki/System_of_units_of_measurement...

Second, even with-in the system itself there was also sorts of inconsistencies. Until just a few years ago there were two "foot" units; one was recently retired:

* https://www.nist.gov/pml/us-surveyfoot

[1] https://en.wikipedia.org/wiki/Avoirdupois

[2] https://en.wikipedia.org/wiki/Troy_weight

[3] https://en.wikipedia.org/wiki/Apothecaries'_system

[4] https://en.wikipedia.org/wiki/United_States_Pharmacopeia

Also:

* https://en.wikipedia.org/wiki/Pound_(mass)

* https://en.wikipedia.org/wiki/Pound_(force)

> Think about it. Imagine you were never taught a measurement system. You find yourself needing to come up with a unit to make measurements for wooden planks you're going to use to build a house. Would you choose a unit as long as a meter? Or one as short as a centimeter or even a decimeter?

Millimeters. That single unit gets you down to very small scales (finer than 1/16") and to large lengths: four significant digits (9999mm) gets you to the equivalent of >32' (~11yd).

* https://web.archive.org/web/20200516223819/https://themetric...

As evidence for this Australia/NZ/EU do everything in millimetres in construction.

spauldo

4 days ago

> US customary is not "thousands" of years

You misunderstood me. It's based on measurements that people have been using for thousands of years. The Romans had feet and miles, for example - not exactly the same lengths, but for the same purposes. The Japanese shaku is almost exactly the same as a US foot. A Japanese Shō is about half a gallon. A Chinese jīn is just slightly larger than a pound. There's a reason for this.

> there was also sorts of inconsistencies

I never claimed otherwise. But do notice that the survey foot and standard foot weren't used for the same purposes, and the difference between them wasn't likely to confuse anyone except maybe people new to the field.

> Here's another one: which weighs more, a pound of feathers or a pound of gold?

Yep, Troy weights. And no one's sure where the Troy system came from. The main reason for its use is because of international trade. Also not something regular people (i.e. people that didn't work directly with precious metals) would have had contact with.

> Millimeters

Hah! Yeah right. Look at all the various non-metric systems that have existed throughout history. Did any of them use something like millimeters to measure wooden planks? Why not?

> As evidence for this Australia/NZ/EU do everything in millimetres in construction.

They do it because the metric system is mandated there and it doesn't give you reasonably sized unit for that scale of work.

Try this: go to a home center (or whatever it's called there - the place you buy building supplies) and measure some drywall. Do the measurements you made agree to the advertised ones within half a millimeter? Compare the dimensions of drywall sheets from different pallets and manufacturers. Do their dimensions agree to within half a millimeter? If not, that's a sure sign you're using units poorly adapted for purpose.

drnick1

4 days ago

They are better for human consumption/understanding. Have you ever had to type an IPv6? It's awful.

cowlevel

4 days ago

How could you ever have really long addresses without having that problem?

mahboi

4 days ago

They don't need to be really long. Adding one more octet to v4 makes it 1 trillion addresses. Sure the header should support longer than that, but it doesn't mean everyone needs to use all of it.

Dagger2

4 days ago

1 trillion addresses isn't anywhere near enough[1]. Remember that we're not talking about L2 here. (...I don't think 1 trillion MACs would even be enough if we want to ensure they're unique, and it seems the IEEE agree with me since they expanded MACs to 64 bits, but that's a different conversation.)

And you already don't have to use all 128 bits in v6. You're forced to use about 48 of them, but the rest is your choice. You can just... not use some of them. It's fine.

[1] https://www.rfc-editor.org/info/rfc1715/

mahboi

4 days ago

The world is already managing with 32 bits of addresses plus NAT, and NAT most likely gives you less than 256 concurrent users per address. But sure, if some cheap ISP only owns a few /32s and needs to use more octets, let them do that, doesn't mean my 4-octet address needs to be super long too.

You're kinda forced to use 128 bits in v6 if you're an end user, cause that's the lowest common denominator. SLAAC is default, DHCP6 is widely unsupported. Most ISPs also only give out a /64 per spec minimum.

Dagger2

3 days ago

NAT is something you use when you're not managing.

The spec minimum is more like /56, so maybe you're forced to use slightly more than 48, but not all 128 bits.

user

4 days ago

[deleted]

cowlevel

3 days ago

Will you repeat the whole dance when you need a second extra octet? There are good reasons IPv6 is designed the way it is.

They considered 64 bit addresses at first but they didn't want to ever risk running out again so they doubled it again.

Try to remember it's not just about the sheer number of addresses - you also want to allocate them in big blocks so that few people ever need to expand their blocks, and they can split their big block into more blocks that are still big.

It's a scenario that's only relevant for a huge company constantly acquiring other companies that operates via zero-trust point-to-point networking and strongly tries to minimize human review - basically Google/Alphabet.

4 days ago

You can run a 4to6 NAT, where specific v6 addresses (the ones you’re talking to) are aliased to reserved v4 addresses out of the PUA.

orangeboats

4 days ago

I have seen people suggesting this before, but it's problematic for a few reasons:

OnlineTux

4 days ago

Why? It was designed and implemented by competent people and continues to work today.

xacky

4 days ago

If you have a dedicated IPv4 address, those behind NAT and CGNAT face significant throttling and false positive blocking. It's been made worse by scraper botnets.

jon128

4 days ago

  https://en.wikipedia.org/wiki/End-to-end_principle

TZubiri

4 days ago

No, backwards compatibility is competence.

throw0101c

4 days ago

> No, backwards compatibility is competence.

Creating an IPng was always going to be complicated:

      So it's a matter of mathematical and physical fact that to expand
      the address size, you must change the protocol, and that means 
      [three] things immediately:

            You have to change the version number.

            You have to add new code to handle the new version.

      […]

            You need a coexistence technique so that updated systems, 
            with the new protocol, can connect to old systems that know 
            nothing of the new protocol.

      Two minutes of thought show that this third requirement has only 
      two solutions:

            (3A) Dual stack, in which the new machines speak both 
                 the old (IPv4) and new (IPng) protocol.

            (3B) Translation, in which something translates addresses
                 between the old and new protocols.

* https://github.com/becarpenter/misc/blob/main/why6why.md

* https://datatracker.ietf.org/doc/html/rfc1671

For anyone curious as to the decision-making process, here are the criteria for what the IETF was looking for in an IPng:

* https://datatracker.ietf.org/doc/html/rfc1726

Here are the candidates that were floating around at the time, and the reason why the winner was chosen:

* https://datatracker.ietf.org/doc/html/rfc1752

TZubiri

4 days ago

This is very valuable, but not sure if you think it contradicts my comment.

I'm not saying that IPv6 is incompetent, or that IPv6 implementations break backward compatibility, or that the problem can be solved without breaking bc.

I'm saying that while IPv6 breaks bc itself, dual stack does not, and even full migrations can maintain bc or gracefully degraded.

In essence, not all implementations IPv6 are good, and not all migrations from IPv4 are responsible, if someone is blindly team IPv6 or blindly team IPv4 in general there's a lack of nuance.

cowlevel

4 days ago

2 days ago

Just addressing the last clause in your post: There are only 5 countries with population greater than 1 million that have a lower population density than Canada: Botswana, Libya, Namibia, Australia, Mongolia.

Looking at all countries it ranks 233/246.

throw0101c

4 days ago

Ran across a comment a while ago on some fun "IPv6 math":

    On the surface of the Earth [land+water], there are 8.4 IPv4 addresses per km². Not counting the oceans, that would be 28 IPv4 addresses per km² land.

    IPv6 gives 10¹⁷ addresses per mm² (yes, square millimetre).

    In terms of volume, 10⁸ IPv6 addresses per mm³ throughout the Earth.

* Via: https://news.ycombinator.com/item?id=28326806#unv_28331245

A second way of thinking about it:

* Stars in the Milky Way: 400 Billion

* Galaxies in the universe: 2 Trillion

* So (4x10¹¹)x(2x10¹²) = 8x10²³ stars in the universe.

* Size of IPv6 address space: 3.4x10³⁸

* Find the ratio between addresses and stars: 3.4x10³⁸ / 8x10²³

IPv6 offers about 430 trillion times more addresses than estimated stars in the universe. From Tom Coffee's presentation "An Enterprise IPv6 Address Planning Case-Study":

* https://www.youtube.com/watch?v=7Tnh4upTOC4

tredre3

4 days ago

That is a fun exercise! However the reality is that public IPv6 is always given out in 48 or 64 bits prefixes (minimum).

- setup an ipv4 tunnel, which will require hacking a VPN to allow TCP listening, and routing connections to some external proxy with a dedicated static ipv4 address

- or do some modem router level nat port forwarding, and use a ddns to avoid ip changes breaking stuff. but that won’t work probably since public ip is shared

will investigate the isp to see if they are truly short in ipv4 or if they are just moving clients off them in order to sell them to higher bidders and plans, which is likely since I’ve been upsold into optic fiber, static ip surcharge, sd-wan, dedicated connection so far

if you have any advice or RIR contacts (or an ipv4 block to donate, invest or sell), I’d be thankful, my email is in my profile

gwbas1c

4 days ago

The first thing you need to ask is: Why do you need IPv4?

I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol? Assuming it's https, why do you need to stick with IPv4?

> Hi, I’m helping a hospital in Buenos Aires that has lost their IPv4 due to their ISP moving to CGNAT, putting their on prem imaging servers offline for 7 days. (it’s ok for us though, we have a backup failover isp)

Two more things:

1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.

2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?

TZubiri

4 days ago

> I don't know much about your imaging servers: Do they accept incoming https connections, or is it some other kind of TCP or UDP protocol?

Yes

>why do you need to stick with IPv4?

To support devices and routes that do not have ipv6 support?

>1: If you require IPv4, that needs to be part of the contract with your ISP. If they just arbitrarily turned you off, it means that you didn't contract for the services you thought you had.

That is correct in principle. Although, in the absence of a contract, if a service has been provided for a long time in one way, I'd say there's an argument for breach of contract when that way changes for the worst.

Another argument for breach of contract, which can work jointly with the previous, are industry standards, as far as they define the terms that are implied by common words like "internet connection".

Finally, there's the specifications themselves, since the service is billed as "internet", one can refer to the Internet Protocol Specification, although if they do offer IPv6, that might be reasonably considered a substitute, it is a material change that was not agreed to originally (this being a pre IPv6 contract). That said, an IPv4 with a local address might technically still be defined as internet, what is broken in this case is TCP, not the IP, although by lacking a public IP address, TCP is broken via an IP protocol failure, so there's an argument that something is being sold as Internet but it isn't really internet, there's no written contract necessary, the term used to describe the product creates the contract in the same way that selling a carton labeled Milk would create a contract based on milk coming from mammaries of a domestic mammal, and not pressed Soy Juice with artificial coloring.

>2: IPv6 is supposed to solve a lot of these problems... So again, why can't you move to IPv6?

I'm open to proposals to moving IPv6, I'm not content with having that be forced and removing it from people and institutions, if there's a shortage, then that means no new IP addresses can be issued, why are we normalizing the removal of IPv4 addresses? Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?

The main issue with IPv6 seems to be IPv6 proponents that try to kill IPv4, no one will migrate if you force them to, if you propose, we will consider.

gwbas1c

4 days ago

The professional services that I work with give plenty of notice (years) before turning off services. Were you using an internet connection that's intended for hosting servers? (As in you were paying for a dedicated static IP.) If so, then you have a case.

Otherwise, your arguments about what "internet" is are flawed. IPv6 has been a thing for about 30 years, with a well-publicized problem with IPv4 address space and migration plan. I suspect that it's (IPv6) older than your hospital's contract. Even in the IPv4 world, your IP can change at any time and you can be put behind a NAT. That's why ISPs will sell you a static IP if you need one.

>> why do you need to stick with IPv4?

> To support devices and routes that do not have ipv6 support?

> Are they being removed from lower priority users in order to serve high priority usecases? If so is a hospital a low priority user?

After reading your response, I suspect the real problem is attitude and experience. The hospital should have IT staff that know to purchase a static IPv4 IP. This should be part of the contract with the ISP. If it wasn't, ultimately it's up to the IT staff to approach the ISP and arrange to purchase one.

TZubiri

4 days ago

> The hospital should have IT staff that know to purchase a static IPv4 IP

I purchased a static IPv4 IP, and they made the CGNAT IP static.

I thought about making a blog post about it, but I realize there's so much nuance and details. I can't tell if it's just venting about work, or a genuinely interesting clusterfuck in some forlorn corner of the new world.

kalleboo

4 days ago

> I purchased a static IPv4 IP, and they made the CGNAT IP static.

Thank you, I needed a good laugh today, that is amazing!

Dagger2

4 days ago

> The main issue with IPv6 seems to be IPv6 proponents that try to kill IPv4, no one will migrate if you force them to, if you propose, we will consider.

My experience is more the opposite. I keep seeing people say things like "I don't do v6 at home because I don't need it". These people are outright telling us that they're not going to start using v6 unless we make them need it.

Note that I didn't say "migrate to" v6. They're not even willing to do the first step of that ("start using v6"), even with no pressure to do the last step ("stop using v4").

I read an anecdote from Facebook that they had huge trouble getting their developers to stop writing v4-only code. Eventually they ended up removing v4 from their developer machines, who all of a sudden were able to write v6-capable code -- and it didn't take long for them to start asking when they could drop support for v4.

People will moan and moan and moan about v6 until you make them use it, at which point they discover that it was never as bad as they imagined it being.

TZubiri

4 days ago

So you admit that IPv6 people routinely create the problem if it doesn't exist. Maybe there's some nuance where you need to go backwards in order to go forwards?

In any case it's not relevant to the case from the root comment, since the ISP doesn't offer IPv6. IPv6 folk are siding with the ISP here or getting distracted with IPv6.

Essentially IPv6 people are delusional about the state of support of the tech and the extent of issues it brings, there's regions where there's no IPv6 support, so when a network with IPv4 has an IP related problem, IPv6 folk will blame it on IPv4 even if it's entirely unrelated, even if the infrastructure isn't even at dual-stack phase.

One of the thing the ISP did was try to upgrade the connection from copper to fiber optics, like instead of understanding the issue, "let's just try upgrading from your OLD technology which is OUTDATED, no wonder you were having issues? Also have you tried turning it off an on again that helps? Talk to you tomorrow.". IPv6 guys so far have been a distraction, get walmart to run their website on IPv6 before you push it to a hospital in southamerica who is having downtime.

Dagger2

3 days ago

No? It wouldn't be taking this long if they could do that.

The problem in this thread stems entirely from v4: they're being moved onto CGNAT (which is NATed v4), because the v4 address space is exhausted, and this is only a problem because the hospital relies completely on v4. None of these problems were created by "IPv6 people". The IPv6 people created the thing that solves these problems.

This hospital has had twenty years to gradually move things over to v6 which would have rendered the CGNAT a non-issue, but instead they've done zero work towards that and are completely unprepared to deal with the realities of v4 running out. Had they been forced to use v6, they would've be fine.

> when a network with IPv4 has an IP related problem, IPv6 folk will blame it on IPv4 even if it's entirely unrelated, even if the infrastructure isn't even at dual-stack phase.

Another opposite. What usually happens is that IPv6 gets blamed for any network problems, even on networks that don't use it.

I've seen people run software that failed to connect to a server's v4 address over a v4-only network due to broken v4, that have then blamed v6 for the problem. The error message from the software was somewhat misleading (it only prints the last connection failure instead of all of them), but even so.

It's usually the people not doing v6 that are delusional about it. Even on HN there's a steady stream of people complaining that v6 didn't do <thing that v6 did do> or that it's impossible to do <thing that's possible to do in v6>.

I do realize that you're likely to hit bugs or lacking support or something somewhere or another, but that's what the past twenty years of gradual transition were for. We've all put a ton of effort into buying you more time to figure this stuff out in. If you squandered all that time and then need to deal with everything after it becomes a big emergency, that's not v6's fault.

> get walmart to run their website on IPv6 before you push it to a hospital in southamerica who is having downtime.

If you wanted a nice orderly transition, you needed to start doing it earlier. Instead everybody is fighting to be the last person to transition, and you probably won't be able to beat Walmart on that fight.

TZubiri

3 days ago

I will reiterate, the ISP does not offer IPv6

jon128

4 days ago

Have you noted that in the mainline Linux build config file, the option to enable IPv4 functionality is CONFIG_LEGACY_IP= ?

I can tell you that in cicd for production Linux systems today, we have

  CONFIG_LEGACY_IP=""

which in a Linux build config file means "do not include this in the build".

What might work well for your organization is ZeroTier which will make you immune to what any ISPs do. The downside is your organization would be dependent on ZeroTier, but ZeroTier is much less likely to screw you over than any ISP.

  https://www.zerotier.com/

I appreciate your speculation on the principles of contract law. Like you, I believe those principles should be upheld and I believe in morality. If you lived under a monarchy and I were of the monarch, I would cross-examine your ISP in public and solve your problem in minutes. I would also on occasion take someone to the side of the road and chop off their head in front of the entire village, and everyone would know on a visceral level they are all much better off with someone taking out the trash now and then.

But, as many technical workers know, the contract stuff takes months or years to resolve, and technical issues involving IP addresses are best worked around with technical approaches.

What I would suggest your network team (you and whoever) do in your shoes is:

- set up NAT64 and DNS64 at the edges of subnets that contain devices that don't do IPv6 properly, because if these devices do not have updates to do IPv6 properly then they are broken in a fundamental way, and a workaround is necessary;

- dictate that starting on December 1st, all new devices and VMs have IPv6 addresses with all userspace services listening on IPv6 addresses or some nftables rule to kludge IPv6:$port -> 127.0.0.1:$port if necessary, with firewall configured to block that IPv6 traffic, then at a later date firewalls not blocking those IPv6 addresses, then at a later date prohibit any new IPv4 addresses being assigned anywhere with special exception to devices tagged "legacy" or "end of life" requiring documentation of such;

- use a combination of IPv6 GUA addresses assigned by whatever ISP and IPv6 ULA addresses chosen by your team -- in IPv6, multiple local gateways and multiple addresses on a network interface issued by those local gateways via RA is relatively a norm rather than an exception (requires userspace tooling in IPv4, DHCP doesn't have this functionality), so leverage this advantage;

- use IPv6 AH (authenticated headers) wherever possible;

- because in an ideal world, ISPs would behave consistently and IPv6 GUA addresses would always be stable, but we aren't living in an ideal world, so be ready to update your internal DNS to drop AAAA records containing IPv6 GUA that an upstream ISP fumbled;

- or, if you have the internal resources, register your own AS and command your own official block of IPv6 addresses;

- use a combination of OpenTOFU (Terraform) and Salt or Ansible, all versioned with Git, be very strict with your team about versioning with Git, to manage everything, and use

  terraform plan -detailed-exitcode

and Salt or Ansible equivalents for continuous monitoring;

- move userspace services to Podman where possible.

Personally I like Salt. I know Ansible is more popular out there with more inertia.

>> why are we normalizing the removal of IPv4 addresses?

This was normalized a long time ago actually. "The future is already here, it's just not evenly distributed".

You and I are total strangers on different corners of the globe. You may not like what you're about to read, but it's better that you get a hint where the wind is blowing sooner than not.

If my team were consulting with your organization's execs and we caught a hint that the existing internal resources were not already proactively staying current with internet protocol (which is IPv6), we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.

Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.

Many network engineers at many ISPs would gladly drop all IPv4 traffic if they thought they could get away with it.

IPv6 only seems more complicated if you still need to unlearn IPv4. IPv6 does have a steeper learning curve, but once that learning curve is overcome, IPv6 is actually much simpler than IPv4. More people than not don't like reading RFCs, but professionals do slowly read RFCs on their own time.

TZubiri

4 days ago

Thanks, I'll take a look into the recommended protocols.

One clarification I'd like to make is that IPv6 is not offered, I can only get IPv4 addresses through the ISP DHCP, there is no ipv6 being offered with command 'dhclient -6' for example on linux, neither does window pick any ipv6 up so it doesn't seem to be an us problem.

It's often that Argentinians miss nuances when copying ethical gray areas from the Americans, and without those slight nuances the debate often gets mixed up with a much more subtle debate.

To make a parallel, Trump issued a memecoin days before entering office, it wasn't technically while being president, it was a memecoin so there was no underlying asset, a gray area, see? America.

Now Milei saw and culted the cargo, he made a coin during his office mandate, and he mentioned it would be used to fund Argentina tech projects, so it's an unregulated security. The nuances are lost, and it's just plain bad.

EDIT1:

>Or, if a detected hint the internal team were at all resistant to IPv6, we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.

>we would point out there is urgency to start right away with emphasis that the existing internal team is over two decades behind staying current.

I appreciate the candor

>You and I are total strangers on different corners of the globe.

This is true and it might impact the nuances and extra-technical semantics of the protocol. For example, in here dropping IPv4 support might mean dropping support for older devices, which might be less common in America, ISPs might not support it, so it's not just about the device but the network, to give you an idea I just got off the phone with the ISP which is THE biggest ISP in Argentina, they don't offer IPv6, period.

>If my team were consulting with your organization's execs

Here might be a big disconnect, my organization execs would probably be way out of budget for whatever your org may charge, that would never happen.

If you want to point the salesmen of your org to try and stir some shit up like that with the ISP, then that may make a bit more sense, the budgets may align for importing American consulting, and berating a big org chart that includes engineers might make more sense than trying to replace a 'team' of 1 or 2 fractionalist generalist IT guys on <500$ month contracts.

The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company. IPv6 is not offered to consumers right now.

>we would advise the executive team to start developing a plan to flush out the replacements for the internal team ASAP.

go nuts

jon128

4 days ago

Everything I am suggesting here is what an internal team with full ownership of the network should do. An external team could chisel little by little, and progress the network in phases.

What is shared here is a general direction. I am sure some people I know where all they do is networking could tell me harshly some of these ways could be done better, and often these people are right ; but sometimes these same people are actually wrong and don't fully consider the positions of people in IT roles at companies that aren't ISPs.

All suggested below is not necessarily the ultimate way but a general direction.

>> can only get IPv4 addresses through the ISP DHCP

ISP-owned IP addresses, either of legacy IP or IPv6, are capricious and can suddenly change, as you experienced recently.

I suggest to adopt a mindset of "our network" and "their network", rather than functionally have your network be a passive extension of their network by using their IP addresses.

The router announcements (IPv6 RA) or DHCP (IPv4) for any IP addresses within your network should always be issued by devices controlled solely by our organization.

NAT64 and tunnels exist, any upstream ISP is not a blocker.

Modern Linux has eBPF and eXpress Data Path. Both Linux and FreeBSD (use HardenedBSD if you can) have DPDK. They can make for surprisingly high performance edge routers on x86_64 server boxes over a decade old, exceeding what most campuses or even datacenter footprints actually need and at low cost. Even without eBPF & XDP or DPDK, these on x86_64 are often "good enough" for router and firewall.

DNS running on these or adjacent boxes internal to the organization is essential.

The addresses at the gateways, either of IPv4 or IPv6, can be made highly available with VRRPv3.

IPv6 has an elegant way to handle multiple upstream ISPs without VRRP or CARP at the gateways, but even Linux is just recently implementing what may only be a piece of them (the BSDs will later), some mention of them here https://news.ycombinator.com/item?id=50143420

What I would do, which is opinionated so I'm not necessarily suggesting others do it, assuming tunneling will be involved: if the organizational wherewithal is there to register an AS and do BGP, is pay the AUD 500 fee to register an AS and have a chunk of IPv6 space for to use IPv6 GUA addresses that officially belong to the organization.

If not, which is often enough the case because we know how some organizations can be slow (not making any assumptions about your's), the remaining avenue is to use IPv6 ULA addresses which are the spiritual counterpart to IPv4 RFC1918 addresses.

You can embed MAC addresses in IPv6 ULA addresses, like the MAC 82c6.7943.acb2 put in an IPv6 like

  fc00:5007:6525:2001:3003:82c6:7943:acb2

and use DHCPv6 to always assign a specific IPv6 ULA address to a specific MAC address, where you have thought through the potential information-disclosure implications and you are certain you want to do that.

Then I would use IPv4-only ISP paths for what they're good for: dumb paths to tunnel IPv6 packets to where there is proper internet.

For the option with an AS, BGP announcements on the other side of the tunnel. Personally I would do SCION on the gateways and out the other side of the tunnel, but you don't want to do SCION unless you are also crazy (like a fox).

For the IPv6 ULA option, PAT which is the spiritual counterpart to IPv4's NAT but is also technologically simpler.

With IPv6 ULA and no tunneling, NAT64 and DNS64 can work for outbound.

Site to site tunnels will be tricky no matter what. Tailscale, ZeroTier, Netbird, and similar may be able to do much of the work for you ; these should run in a DMZ on another side of a router/firewall that filters the appropriate IPv6 ULA prefixes.

I would try to see if I could make vanilla Wireguard work with NAT traversal techniques using some cloud-hosted VMs that help with the "hole punching", but not everyone would do that.

There aren't many options that will all work well but almost always more than one option that can work well, all subject to the specific site and inter-organizational resources.

>> dropping IPv4 support might mean dropping support for older devices

For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.

With Salt or Ansible, such a scheme with NAT, DNS, DHCP configuration may all be templatized and in perfect alignment, and is scalable.

Authoritative inventory of canonical identifiers/names versioned with Git, what Ansible calls "inventory", is imperative.

Sometimes this looks like a couple of old x86_64 boxes doing CARP (similar to VRRP) on the IPv4 side for a few dozen or couple hundred devices downstream.

Sometimes this looks like, in a handful of distant corners of the larger network, a cheap single-board computer between a single device and the rest of the network ; without a wifi chip or the wifi chip removed by heating (board-repair style), unless downstream of a wifi AP.

>> the ISP which is THE biggest ISP in Argentina, they don't offer IPv6 >> The ISP brand is Personal, local corp is Telecom Argentina S.A, Asynchronous System Number AS7303, trades as TEO in NYSE I think, owned by Grupo Clarin which comes is a traditional Media and news company.

I can think of some service provider network engineers that would gladly drop all of Argentina's IPv4 off the entire internet and "IPv6 prefix announcements welcome", if the business sides would let them do it.

Something like this will probably start happening sooner than people think.

TZubiri

4 days ago

>I can think of some service provider network engineers that would gladly drop all of Argentina's IPv4 off the entire internet and "IPv6 prefix announcements welcome", if the business sides would let them do it.

Yes, there's no shortage of employees that would vote to reduce their workload by removing their service offering, if you ask a physician here if the hospital should stop taking patients of X type, they'd be onboard, less work for them.

It's a dream though, try to make an AAAA request for any website, it's not there, even government websites.

>Something like this will probably start happening sooner than people think.

I'm even trying american companies, like citi.com, walmart.com, there's no AAAA records there.

>For as long as it makes organizational sense to continue using these devices, put them behind an OpenBSD box that performs NAT46 and DNS46, with IPv4 addresses statically mapped to IPv6 addresses, maybe ones that contain the MAC addresses of the devices.

This is an external facing service, so we don't control the devices or routes that patients and external physicians will be accessing the website.

>Tunneling

Yeah, I'm going to go this route, IPv4 tunnel, it's a horrible hack, but this is hacker news after all.

jon128

4 days ago

Almost all large companies in the US are on IPv6 and more of the smaller companies are on IPv6 than not.

If your device isn't able to reach 2606:4700:4700::1111, try using the DNS server 1.1.1.1

and run this bash command:

  for  USCompany  in    apple akamai att berkshire bestbuy boeing bofa burgerking cnn chase chevron citi comcast costco cvs dell disney fedex fidelity gatorade google goldmansachs gopro hellofresh hilton homedepot infowars in-n-out jcpenny johnsonandjohnson kaiser kroger lulumon macys mcdonalds microsoft nike pepsi petco radioshack safeway shell southwest sprouts statefarm tacobell target tesla traderjoes ups usbank uschamber walgreens walmart wellsfargo wholefoods yahoo    aquantuo atlanticseafarms beehivemeals beetlesplumbing dynamicautomotive jamies-farm joeandbella jovyco privacy4cars prosperityehr redroostercoffee resortlifecarts sproutlabs tradedesignbuild 
  do
    echo ${USCompany}
    dig +short aaaa www.${USCompany}.com
    echo  ; done

and this one too

  for  USent  in    cia congress dhs epa ice fbi fcc nasa nsa whitehouse
  do
    echo ${USent}
    dig +short aaaa www.${USent}.gov
    echo  ; done

Then maybe call up your ISP and rant about them allowing your country to devolve into some 3rd world shit hole stuck on legacy IP and over two decades behind the Western countries.

Argentina deserves better!

TZubiri

4 days ago

>If your device isn't able to reach 2606:4700:4700::1111, try using the DNS server 1.1.1.1

We run a public facing server, we aren't going to ask patients and external physicians to configure a DNS or run a (linux) script

>Then maybe call up your ISP and rant

You wouldn't be surprised how unhelpful and unfun that is

jon128

4 days ago

  user@host:~$ dig +short  aaaa  www.citi.com
  san.www.citi.com.edgekey.net.
  e16976.x.akamaiedge.net.

  user@host:~$ dig +short  aaaa  www.walmart.com
  www.walmart.com.cdn-wal.net.

You should run the commands yourself, not your end users. Obvio.

TZubiri

3 days ago

those are CNAMEs not AAAA, and the CNAME chain doesn't end up resolving to IPv6, only IPv4.

jon128

3 days ago

Yeah I had later noticed that too. Much of the US companies do end up resolving to IPv6.

100% of the aforementioned US gov domains resolve to IPv6.

More 5G networks than not are using IPv6 and 464xlat. Many ISPs are IPv6 only too so closer to half the time than not there are IPv6 packets to reach to those IPv4 addresses.

  $   for  USCompany  in    apple akamai att berkshire bestbuy boeing bofa burgerking cnn chase chevron citi comcast costco cvs dell disney fedex fidelity gatorade google goldmansachs gopro hellofresh hilton homedepot infowars in-n-out jcpenny johnsonandjohnson kaiser kroger lulumon macys mcdonalds microsoft nike pepsi petco radioshack safeway shell southwest sprouts statefarm tacobell target tesla traderjoes ups usbank uschamber walgreens walmart wellsfargo wholefoods yahoo    aquantuo atlanticseafarms beehivemeals beetlesplumbing dynamicautomotive jamies-farm joeandbella jovyco privacy4cars prosperityehr redroostercoffee resortlifecarts sproutlabs tradedesignbuild 
    do
      echo ${USCompany}
      dig +short aaaa www.${USCompany}.com
      echo  ; done
  apple
  www-apple-com.v.aaplimg.com.
  www.apple.com.edgekey.net.
  e6858.dsce9.akamaiedge.net.
  2600:1406:3a00:493::1aca
  2600:1406:3a00:492::1aca
  2600:1406:3a00:494::1aca
  2600:1406:3a00:486::1aca
  2600:1406:3a00:48a::1aca
  
  akamai
  www.akamai.com.edgekey.net.
  2600:1406:2e00:49::172e:d8cf
  2600:1406:2e00:49::172e:d8c6
  
  att
  prod-www.zr-att.com.akadns.net.
  cac2.m.att.com.edgekey.net.
  e11697.cd.akamaiedge.net.
  
  berkshire
  3tfzq88u2cbx.wpeproxy.com.
  
  bestbuy
  www.bestbuy.com.edgekey.net.
  e5816.x.akamaiedge.net.
  
  boeing
  d1pt7e7bvjlgwo.cloudfront.net.
  2600:9000:24bc:7a00:16:a4e1:f600:93a1
  2600:9000:24bc:3600:16:a4e1:f600:93a1
  2600:9000:24bc:b400:16:a4e1:f600:93a1
  2600:9000:24bc:e000:16:a4e1:f600:93a1
  2600:9000:24bc:6e00:16:a4e1:f600:93a1
  2600:9000:24bc:be00:16:a4e1:f600:93a1
  2600:9000:24bc:fc00:16:a4e1:f600:93a1
  2600:9000:24bc:c000:16:a4e1:f600:93a1
  
  bofa
  redirect.ecglb.bac.com.
  
  burgerking
  prod-bk-us-web.com.rbi.tools.
  
  cnn
  cnn-tls.map.fastly.net.
  2a04:4e42:200::773
  2a04:4e42:400::773
  2a04:4e42:600::773
  2a04:4e42::773
  
  chase
  gtm.www.chase.com.akadns.net.
  www.chase.com.edgekey.net.
  e129412.a.akamaiedge.net.
  
  chevron
  www-afd-b9aycqabggbkcsdt.z01.azurefd.net.
  mr-z01.tm-azurefd.net.
  2603:1061:14:95::1
  
  citi
  san.www.citi.com.edgekey.net.
  e16976.x.akamaiedge.net.
  
  comcast
  www.comcast.com.edgekey.net.
  e523.dscb.akamaiedge.net.
  2600:1406:3a00:482::20b
  2600:1406:3a00:48d::20b
  
  costco
  costco.map.fastly.net.
  
  cvs
  www.cvs.edgekey.net.
  e5769.x.akamaiedge.net.
  
  dell
  www1.dell-cidr.akadns.net.
  cdn-www.dell.com-v2.edgekey.net.
  e13665.x.akamaiedge.net.
  
  disney
  www-cdn.matterhorn.app.
  
  fedex
  www.fedex.com.akadns.net.
  cidr.fedex.com.akadns.net.
  ipv6www.fedex.com.edgekey.net.
  e111296.dsca.akamaiedge.net.
  2600:1406:2e00:49::172e:d8cc
  2600:1406:2e00:49::172e:d8c8
  2600:1406:2e00:49::172e:d8d0
  2600:1406:2e00:49::172e:d8ca
  2600:1406:2e00:49::172e:d8c4
  
  fidelity
  www.fidelity.com.edgekey.net.
  e94446.x.akamaiedge.net.
  
  gatorade
  2606:4700:4409::ac40:9261
  2a06:98c1:3105::6812:299f
  
  google
  2001:4860:482d:7700::
  2001:4860:482a:7700::
  2001:4860:4828:7700::
  2001:4860:4827:7700::
  2001:4860:482c:7700::
  2001:4860:4826:7700::
  2001:4860:4829:7700::
  2001:4860:482b:7700::
  
  goldmansachs
  www.gs.com.
  www.gs.com.edgekey.net.
  e17133.x.akamaiedge.net.
  
  gopro
  d1h7n50c10z72v.cloudfront.net.
  2600:9000:201e:6800:17:765c:a5c0:93a1
  2600:9000:201e:4c00:17:765c:a5c0:93a1
  2600:9000:201e:a200:17:765c:a5c0:93a1
  2600:9000:201e:2400:17:765c:a5c0:93a1
  2600:9000:201e:a800:17:765c:a5c0:93a1
  2600:9000:201e:fe00:17:765c:a5c0:93a1
  2600:9000:201e:ca00:17:765c:a5c0:93a1
  2600:9000:201e:c200:17:765c:a5c0:93a1
  
  hellofresh
  www.hellofresh.com.cdn.cloudflare.net.
  2606:4700:4409::6812:209d
  2a06:98c1:3106::ac40:9b63
  
  hilton
  www.hilton.com.edgekey.net.
  e2904.dscx.akamaiedge.net.
  2600:1406:2e00:49a::b58
  2600:1406:2e00:4a3::b58
  
  homedepot
  www.homedepot.com.edgekey.net.
  e301254.x.akamaiedge.net.
  
  infowars
  2606:4700:10::6814:1a60
  2606:4700:10::ac42:9d27
  
  in-n-out
  sw6cs.x.incapdns.net.
  
  jcpenny
  www.jcpenny.com.edgesuite.net.
  a1441.b.akamai.net.
  
  johnsonandjohnson
  prod.jnj.psdops.com.
  
  kaiser
  kaiser.com.
  2001:1ab0:7e1e:151::58
  
  kroger
  www.kroger.com.edgekey.net.
  e8023.a.akamaiedge.net.
  
  lulumon
  lulumon.com.
  
  macys
  www.macys.com.edgekey.net.
  e5791.a.akamaiedge.net.
  
  mcdonalds
  direct-san.mcdonalds.com.edgekey.net.
  e179224.a.akamaiedge.net.
  
  microsoft
  www.microsoft.com-c-3.edgekey.net.
  e13678.dscb.akamaiedge.net.
  2600:1406:3a00:487::356e
  2600:1406:3a00:486::356e
  2600:1406:3a00:497::356e
  2600:1406:3a00:481::356e
  2600:1406:3a00:482::356e
  
  nike
  www.nike.com-v1.edgekey.net.
  e2785.x.akamaiedge.net.
  
  pepsi
  g2wh497.x.incapdns.net.
  
  petco
  2a06:98c1:3108::6812:20c7
  2a06:98c1:310a::ac40:9b39
  
  radioshack
  prod.magentocloud.map.fastly.net.
  2a04:4e42::380
  2a04:4e42:200::380
  2a04:4e42:400::380
  2a04:4e42:600::380
  
  safeway
  htu5x69.x.incapdns.net.
  
  shell
  www.nic.shell.edgekey.net.
  e200089.dscb.akamaiedge.net.
  2600:1406:3a00:33::170b:cfef
  2600:1406:3a00:33::170b:cfe6
  
  southwest
  www.southwest.com.edgekey.net.
  e7466.a.akamaiedge.net.
  
  sprouts
  2606:4700:10::ac42:9705
  2606:4700:10::6814:2445
  
  statefarm
  statefarm.edgekey.net.
  e124943.a.akamaiedge.net.
  
  tacobell
  www.tacobell-prod.com.edgekey.net.
  e78335.b.akamaiedge.net.
  
  target
  sites.target.map.fastly.net.
  
  tesla
  www.tesla.com.edgekey.net.
  e1792.dscx.akamaiedge.net.
  2600:1406:3a00:291::700
  2600:1406:3a00:280::700
  2600:1406:3a00:293::700
  2600:1406:3a00:290::700
  2600:1406:3a00:296::700
  
  traderjoes
  www.traderjoes.com.edgekey.net.
  e4528.b.akamaiedge.net.
  
  ups
  ev.ups.com.akadns.net.
  ev2b.ups.com.edgekey.net.
  e13626.dsca.akamaiedge.net.
  2600:1406:2e00:986::353a
  2600:1406:2e00:98b::353a
  2600:1406:2e00:983::353a
  2600:1406:2e00:984::353a
  
  usbank
  www.usbank.com.edgekey.net.
  e374753.a.akamaiedge.net.
  
  uschamber
  uschamber.map.fastly.net.
  
  walgreens
  walgreens.com.edgekey.net.
  e36070.dsca.akamaiedge.net.
  2600:1406:2e00:20::45c0:8be8
  2600:1406:2e00:20::45c0:8bda
  
  walmart
  www.walmart.com.cdn-wal.net.
  
  wellsfargo
  www.wellsfargo.com.edgekey.net.
  e82164.b.akamaiedge.net.
  
  wholefoods
  2600:9000:25ef:c800:8:df9e:eb80:93a1
  2600:9000:25ef:e000:8:df9e:eb80:93a1
  2600:9000:25ef:7400:8:df9e:eb80:93a1
  2600:9000:25ef:6400:8:df9e:eb80:93a1
  2600:9000:25ef:ca00:8:df9e:eb80:93a1
  2600:9000:25ef:9e00:8:df9e:eb80:93a1
  2600:9000:25ef:5400:8:df9e:eb80:93a1
  2600:9000:25ef:fa00:8:df9e:eb80:93a1
  
  yahoo
  me-ycpi-cf-www.g06.yahoodns.net.
  2001:4998:18:800::4003
  2001:4998:18:800::4002
  
  aquantuo
  2606:4700:20::681a:2e
  2606:4700:20::681a:12e
  2606:4700:20::ac43:4547
  
  atlanticseafarms
  2606:4700:3033::6815:4581
  2606:4700:3035::ac43:d0b4
  
  beehivemeals
  beehivemeals.myshopify.com.
  shops.myshopify.com.
  2620:127:f00f:e::
  
  beetlesplumbing
  s.multiscreensite.com.
  global.multiscreensite.com.
  a3c02b2530d6f27ca.awsglobalaccelerator.com.
  
  dynamicautomotive
  dynamicautomotive.com.
  
  jamies-farm
  shops.myshopify.com.
  2620:127:f00f:e::
  
  joeandbella
  joebella.myshopify.com.
  shops.myshopify.com.
  2620:127:f00f:e::
  
  jovyco
  jovy-brand.myshopify.com.
  shops.myshopify.com.
  2620:127:f00f:e::
  
  privacy4cars
  2606:4700:20::681a:dca
  2606:4700:20::ac43:4af6
  2606:4700:20::681a:cca
  
  prosperityehr
  2606:4700:10::6814:2f68
  2606:4700:10::ac42:94bd
  
  redroostercoffee
  cname.vercel-dns.com.
  
  resortlifecarts
  sprod-dnn-gce6a8hab5g5bkf6.a03.azurefd.net.
  mr-a03.tm-azurefd.net.
  2603:1061:14:99::1
  
  sproutlabs
  cdn.webflow.com.
  2620:cb:2000::1
  
  tradedesignbuild
  ext-sq.squarespace.com.



  $   for  USent  in    cia congress dhs epa ice fbi fcc nasa nsa whitehouse
    do
      echo ${USent}
      dig +short aaaa www.${USent}.gov
      echo  ; done
  cia
  cia.gov.edgekey.net.
  e10004744.dsca.akamaiedge.net.
  2600:1406:3a00:33::170b:cfeb
  2600:1406:3a00:33::170b:cff2
  
  congress
  2606:4700:4402::ac40:90ce
  2a06:98c1:3109::6812:2b32
  
  dhs
  www.dhs.gov.edgekey.net.
  e6485.dsca.akamaiedge.net.
  2600:1406:2e00:98b::1955
  2600:1406:2e00:983::1955
  
  epa
  d32i4z0dxazdtp.cloudfront.net.
  2600:9000:201e:a600:10:f3db:af40:93a1
  2600:9000:201e:f400:10:f3db:af40:93a1
  2600:9000:201e:6000:10:f3db:af40:93a1
  2600:9000:201e:c400:10:f3db:af40:93a1
  2600:9000:201e:b600:10:f3db:af40:93a1
  2600:9000:201e:d200:10:f3db:af40:93a1
  2600:9000:201e:d600:10:f3db:af40:93a1
  2600:9000:201e:6400:10:f3db:af40:93a1
  
  ice
  www.ice.gov.edgekey.net.
  e6485.dsca.akamaiedge.net.
  2600:1406:2e00:98b::1955
  2600:1406:2e00:983::1955
  
  fbi
  www.fbi.gov.cdn.cloudflare.net.
  2606:4700::6810:94f4
  2606:4700::6810:95f4
  
  fcc
  www.fcc.gov.edgekey.net.
  e4909.dscb.akamaiedge.net.
  2600:1406:3a00:484::132d
  2600:1406:3a00:497::132d
  
  nasa
  nasa-gov.go-vip.net.
  2a04:fa87:fffd::c000:426c
  
  nsa
  nsa.gov.edgekey.net.
  e16248.dscb.akamaiedge.net.
  2600:1406:3a00:487::3f78
  2600:1406:3a00:496::3f78
  
  whitehouse
  wh47.go-vip.net.
  2a04:fa87:fffd::c000:4233

jon128

4 days ago

If the www. is prefixed or not, results for domains of Argentina differ. The results aren't almost-perfect like US, but IPv6 is apparently already somewhat prevalent in Argentina.

The list from ChatGPT:

"This 2026 list ranks organizations by LinkedIn employee count, not revenue, and includes public bodies and universities as well as companies. I’ve kept the listed order; entries without a domain in the source are omitted."

  $ for argdo in $(cat arg2) ; do echo $argdo ; dig +short aaaa $argdo  ;  echo ; done
  www.tytconsultores.com.ar
  
  www.mercadolibre.com
  a35f64fceb718ad27.awsglobalaccelerator.com.
  
  www.es.wikipedia.org
  
  www.dyna.wikimedia.org.
  
  www.techintgroup.com
  fdcomm01-egdmdkhuhfbgb9gx.z01.azurefd.net.
  mr-z01.tm-azurefd.net.
  2603:1061:14:90::1
  
  www.cencosud.com
  www.cencosud.com.cdn.cloudflare.net.
  2606:4700::6812:247
  2606:4700::6812:347
  
  www.ypf.com
  ypf.com.
  
  www.gob.ar
  
  www.uba.ar
  aijewx4.ng.impervadns.net.
  
  www.coto.com.ar
  
  www.somosjob.ar
  somosjob.ar.
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.telecom.com.ar
  
  www.arcor.com
  arcor.P0585910867.fortiwebcloud.net.
  lb-3.us-east-1.aws.waas-online.net.
  
  www.techint.com
  techintcomprd.azurewebsites.net.
  waws-prod-cq1-003.sip.azurewebsites.windows.net.
  waws-prod-cq1-003.brazilsouth.cloudapp.azure.com.
  
  www.abc.gob.ar
  
  www.century21.com.ar
  
  www.uca.edu.ar
  
  www.galicia.ar
  
  www.osde.com.ar
  
  www.elalmacen.tv
  cdn3.wixdns.net.
  cfd.wixdns.net.
  
  www.carrefour.com.ar
  2a06:98c1:3108::ac40:9379
  2a06:98c1:3108::6812:2887
  
  www.unlp.edu.ar
  2800:340:0:64::135
  
  www.somosfarmacity.com
  farmacitybr02-bzf9h8a2fmbbfyeb.z01.azurefd.net.
  mr-z01.tm-azurefd.net.
  2603:1061:14:97::1
  
  www.hospitalitaliano.org.ar
  
  www.andreani.com
  www.andreani.com.cdn.cloudflare.net.
  2606:4700::6812:161a
  2606:4700::6812:171a
  
  www.mostazaweb.com.ar
  
  www.aesa.com.ar
  aesa.com.ar.
  
  www.claroempleos-aup.com
  
  www.swissmedical.com.ar
  swissmedical.com.ar.
  
  www.unc.edu.ar
  2801:120:842::5
  2801:120:842::4
  2801:120:842::6
  
  www.bbva.com.ar
  www.bbva.com.ar.edgekey.net.
  e6251.a.akamaiedge.net.
  
  www.bna.com.ar
  bna.com.ar.
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.accenture.com
  4229prod2cf.r53cioaccenturecloud.net.
  d13iavm24b37u0.cloudfront.net.
  2600:9000:25f2:0:d:5159:5a00:93a1
  2600:9000:25f2:7e00:d:5159:5a00:93a1
  2600:9000:25f2:bc00:d:5159:5a00:93a1
  2600:9000:25f2:2600:d:5159:5a00:93a1
  2600:9000:25f2:2e00:d:5159:5a00:93a1
  2600:9000:25f2:9000:d:5159:5a00:93a1
  2600:9000:25f2:6a00:d:5159:5a00:93a1
  2600:9000:25f2:ca00:d:5159:5a00:93a1
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.aerolineas.com.ar
  
  www.bancoprovincia.com.ar
  
  www.ocasa.com
  ocasa.com.
  
  www.macro.com.ar
  
  www.arca.gob.ar
  
  www.laanonima.com.ar
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.naranjax.com
  2a06:98c1:3105::ac40:95eb
  2606:4700:440b::6812:2615
  
  www.informeg.com.ar
  informeg.com.ar.
  
  www.gruposancorseguros.com
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.pecomenergia.com
  dam5tpv20rcp8.cloudfront.net.
  
  www.santander.com.ar
  www.santander.com.ar.edgekey.net.
  e90036.dscb.akamaiedge.net.
  2600:1406:2e00:28::17cb:a618
  2600:1406:2e00:28::17cb:a60d
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.2606:4700:20::681a:4b7
  
  www.2606:4700:20::681a:5b7
  
  www.2606:4700:20::ac43:4b23
  
  www.unr.edu.ar
  
  www.utn.edu.ar
  
  www.cerveceriaymalteriaquilmes.com
  ug2aj8e.x.incapdns.net.
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.adecoagro.com
  hostweb.adecoagro.com.
  
  www.mendoza.edu.ar
  
  www.veronicapalermo.com.ar
  
  www.uncuyo.edu.ar
  
  www.toyota.com.ar
  d14rtqisu6jdh1.cloudfront.net.
  2600:9000:211f:7800:e:6ac2:3d40:93a1
  2600:9000:211f:c800:e:6ac2:3d40:93a1
  2600:9000:211f:2600:e:6ac2:3d40:93a1
  2600:9000:211f:b200:e:6ac2:3d40:93a1
  2600:9000:211f:3200:e:6ac2:3d40:93a1
  2600:9000:211f:7400:e:6ac2:3d40:93a1
  2600:9000:211f:6800:e:6ac2:3d40:93a1
  2600:9000:211f:a600:e:6ac2:3d40:93a1
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.uade.edu.ar
  
  www.diaonline.supermercadosdia.com.ar
  
  www.pan-energy.com
  
  www.sancorsalud.com.ar
  
  www.ar.linkedin.com
  
  www.cctld.linkedin.com.
  
  www.cctld.es.lnkdns.net.
  
  www.www.linkedin.com.cdn.cloudflare.net.
  
  www.rosario.gob.ar
  websrv2.rosario.gob.ar.
  
  www.mpf.gob.ar
  
  www.aysa.com.ar
  aysa.com.ar.
  
  www.uai.edu.ar
  alb-virt02-umbraco-503988087.us-east-1.elb.amazonaws.com.
  
  www.hospitalsanjuandedios.org.ar
  
  www.telecentro.com.ar
  
  www.nadro.mx
  d1j9d2nbk27vjw.cloudfront.net.
  2600:9000:21dd:8a00:3:847:5f00:93a1
  2600:9000:21dd:7400:3:847:5f00:93a1
  2600:9000:21dd:4200:3:847:5f00:93a1
  2600:9000:21dd:5a00:3:847:5f00:93a1
  2600:9000:21dd:1000:3:847:5f00:93a1
  2600:9000:21dd:fa00:3:847:5f00:93a1
  2600:9000:21dd:7c00:3:847:5f00:93a1
  2600:9000:21dd:200:3:847:5f00:93a1
  
  www.usal.edu.ar
  
  www.hospitalaleman.org.ar
  22pt6nf.impervadns.net.
  
  www.pluspetrol.net
  environmental-longan-72bw7rzlnwqdk0vjpbrlycnz.herokudns.com.
  
  www.edenor.com
  d14d07xru8rz5.cloudfront.net.
  2600:9000:21dd:f800:10:d7ce:6840:93a1
  2600:9000:21dd:9a00:10:d7ce:6840:93a1
  2600:9000:21dd:9600:10:d7ce:6840:93a1
  2600:9000:21dd:aa00:10:d7ce:6840:93a1
  2600:9000:21dd:8a00:10:d7ce:6840:93a1
  2600:9000:21dd:6600:10:d7ce:6840:93a1
  2600:9000:21dd:4c00:10:d7ce:6840:93a1
  2600:9000:21dd:6400:10:d7ce:6840:93a1
  
  www.cge.entrerios.gov.ar
  
  www.supervielle.com.ar
  
  www.pwc.com.ar
  www.pwc.com.ar.edgekey.net.
  e675.x.akamaiedge.net.
  
  www.mdp.edu.ar
  proxy.mdp.edu.ar.
  
  www.hospitalbritanico.org.ar
  ambitious-field-049c5d310.1.azurestaticapps.net.
  azurestaticapps1.trafficmanager.net.
  msha-slice-1-wus2-0.msha-slice-1-wus2-0-ase.p.azurewebsites.net.
  waws-prod-mwh-a269a7b8.sip.p.azurewebsites.windows.net.
  
  www.edu.ar
  
  www.gov.ar
  
  www.gdmseeds.com
  wp.wpenginepowered.com.
  
  www.iosfa.gob.ar
  2606:4700:3035::6815:25b7
  2606:4700:3037::ac43:d3a2
  
  www.unsam.edu.ar
  2606:4700:20::ac43:4b64
  2606:4700:20::681a:b10
  2606:4700:20::681a:a10
  
  www.newsan.com.ar
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.argentina.gob.ar
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  2606:4700:20::681a:4b7
  
  www.edilizia.com.ar
  www.edilizia.com.ar.cdn.hstgr.net.
  2a02:4780:50:83e3:2d34:afe1:afaf:97bc
  2a02:4780:4e:a704:36c6:c5a7:478e:3a77
  
  www.hospitalaustral.edu.ar
  adc.hospitalaustral.edu.ar.
  
  www.unne.edu.ar
  wwwproxy.unne.edu.ar.
  
  www.bsg.global
  
  www.icbc.com.ar
  
  www.uca.edu.ar
  
  www.uns.edu.ar
  uns.edu.ar.
  
  www.fravega.com
  
  www.grupopetersen.com.ar
  376ee70d1c774050adbdb0e659a74dd5.v1.radwarecloud.net.



  $ echo ;  for  Argentina_Domain  in   tytconsultores.com.ar mercadolibre.com es.wikipedia.org techintgroup.com cencosud.com ypf.com gob.ar uba.ar coto.com.ar somosjob.ar argentina.gob.ar telecom.com.ar arcor.com techint.com abc.gob.ar century21.com.ar uca.edu.ar galicia.ar osde.com.ar elalmacen.tv carrefour.com.ar unlp.edu.ar somosfarmacity.com hospitalitaliano.org.ar andreani.com mostazaweb.com.ar aesa.com.ar claroempleos-aup.com swissmedical.com.ar unc.edu.ar bbva.com.ar bna.com.ar argentina.gob.ar accenture.com argentina.gob.ar aerolineas.com.ar bancoprovincia.com.ar ocasa.com macro.com.ar arca.gob.ar laanonima.com.ar argentina.gob.ar naranjax.com informeg.com.ar mseg.gba.gov.ar gruposancorseguros.com axionenergy.com argentina.gob.ar pecomenergia.com santander.com.ar argentina.gob.ar unr.edu.ar utn.edu.ar cerveceriaymalteriaquilmes.com argentina.gob.ar adecoagro.com mendoza.edu.ar veronicapalermo.com.ar uncuyo.edu.ar toyota.com.ar argentina.gob.ar uade.edu.ar diaonline.supermercadosdia.com.ar pan-energy.com sancorsalud.com.ar ar.linkedin.com rosario.gob.ar mpf.gob.ar aysa.com.ar uai.edu.ar hospitalsanjuandedios.org.ar telecentro.com.ar nadro.mx usal.edu.ar hospitalaleman.org.ar pluspetrol.net edenor.com cge.entrerios.gov.ar supervielle.com.ar pwc.com.ar mdp.edu.ar hospitalbritanico.org.ar edu.ar gov.ar gdmseeds.com iosfa.gob.ar unsam.edu.ar newsan.com.ar argentina.gob.ar argentina.gob.ar edilizia.com.ar hospitalaustral.edu.ar unne.edu.ar bsg.global icbc.com.ar uca.edu.ar uns.edu.ar fravega.com grupopetersen.com.ar   ;    do     echo $Argentina_Domain   ;   dig +short aaaa $Argentina_Domain   ;  echo    ; done
  
  tytconsultores.com.ar
  
  mercadolibre.com
  
  es.wikipedia.org
  dyna.wikimedia.org.
  2620:0:863:ed1a::1
  
  techintgroup.com
  
  cencosud.com
  
  ypf.com
  
  gob.ar
  
  uba.ar
  
  coto.com.ar
  
  somosjob.ar
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  telecom.com.ar
  
  arcor.com
  
  techint.com
  
  abc.gob.ar
  
  century21.com.ar
  
  uca.edu.ar
  
  galicia.ar
  
  osde.com.ar
  
  elalmacen.tv
  
  carrefour.com.ar
  2a06:98c1:3108::ac40:9379
  2a06:98c1:3108::6812:2887
  
  unlp.edu.ar
  2800:340:0:64::135
  
  somosfarmacity.com
  
  hospitalitaliano.org.ar
  
  andreani.com
  
  mostazaweb.com.ar
  
  aesa.com.ar
  
  claroempleos-aup.com
  
  swissmedical.com.ar
  
  unc.edu.ar
  2801:120:842::4
  2801:120:842::5
  2801:120:842::6
  
  bbva.com.ar
  
  bna.com.ar
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  accenture.com
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  aerolineas.com.ar
  
  bancoprovincia.com.ar
  
  ocasa.com
  
  macro.com.ar
  
  arca.gob.ar
  
  laanonima.com.ar
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  naranjax.com
  2a06:98c1:3105::ac40:95eb
  2606:4700:440b::6812:2615
  
  informeg.com.ar
  
  mseg.gba.gov.ar
  
  gruposancorseguros.com
  
  axionenergy.com
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  pecomenergia.com
  
  santander.com.ar
  2600:1406:bc00:6a::172b:330f
  2600:1406:bc00:6a::172b:330d
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  unr.edu.ar
  
  utn.edu.ar
  
  cerveceriaymalteriaquilmes.com
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  adecoagro.com
  
  mendoza.edu.ar
  
  veronicapalermo.com.ar
  
  uncuyo.edu.ar
  
  toyota.com.ar
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  uade.edu.ar
  
  diaonline.supermercadosdia.com.ar
  diaonline.supermercadosdia.com.ar.cdn.vtex.com.
  d3p7gg3f271ro.cloudfront.net.
  2600:9000:204d:5200:9:b144:ad00:93a1
  2600:9000:204d:7200:9:b144:ad00:93a1
  2600:9000:204d:7800:9:b144:ad00:93a1
  2600:9000:204d:9400:9:b144:ad00:93a1
  2600:9000:204d:8000:9:b144:ad00:93a1
  2600:9000:204d:5000:9:b144:ad00:93a1
  2600:9000:204d:6400:9:b144:ad00:93a1
  2600:9000:204d:4a00:9:b144:ad00:93a1
  
  pan-energy.com
  
  sancorsalud.com.ar
  
  ar.linkedin.com
  cctld.linkedin.com.
  cctld.es.lnkdns.net.
  www.linkedin.com.cdn.cloudflare.net.
  2a06:98c1:3109::6812:2929
  2a06:98c1:310b::ac40:92d7
  
  rosario.gob.ar
  
  mpf.gob.ar
  
  aysa.com.ar
  
  uai.edu.ar
  
  hospitalsanjuandedios.org.ar
  
  telecentro.com.ar
  
  nadro.mx
  
  usal.edu.ar
  
  hospitalaleman.org.ar
  
  pluspetrol.net
  
  edenor.com
  2600:9000:21dd:4000:10:d7ce:6840:93a1
  2600:9000:21dd:fc00:10:d7ce:6840:93a1
  2600:9000:21dd:6a00:10:d7ce:6840:93a1
  2600:9000:21dd:7a00:10:d7ce:6840:93a1
  2600:9000:21dd:2000:10:d7ce:6840:93a1
  2600:9000:21dd:5e00:10:d7ce:6840:93a1
  2600:9000:21dd:7000:10:d7ce:6840:93a1
  2600:9000:21dd:e000:10:d7ce:6840:93a1
  
  cge.entrerios.gov.ar
  
  supervielle.com.ar
  
  pwc.com.ar
  
  mdp.edu.ar
  
  hospitalbritanico.org.ar
  
  edu.ar
  
  gov.ar
  
  gdmseeds.com
  
  iosfa.gob.ar
  2606:4700:3035::6815:25b7
  2606:4700:3037::ac43:d3a2
  
  unsam.edu.ar
  2606:4700:20::ac43:4b64
  2606:4700:20::681a:a10
  2606:4700:20::681a:b10
  
  newsan.com.ar
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  argentina.gob.ar
  2606:4700:20::681a:4b7
  2606:4700:20::681a:5b7
  2606:4700:20::ac43:4b23
  
  edilizia.com.ar
  2a02:4780:84:881e:443e:9364:14fd:ed8f
  2a02:4780:84:8c81:c13b:f920:84f2:6f33
  
  hospitalaustral.edu.ar
  
  unne.edu.ar
  
  bsg.global
  
  icbc.com.ar
  
  uca.edu.ar
  
  uns.edu.ar
  
  fravega.com
  
  grupopetersen.com.ar

cowlevel

4 days ago

You're a hospital. You have an actual contract with the ISP, right? Does it say you get an IPv4 address? If not, ask them for one, and pay up.

You don't need an address block from an RIR. You just need your ISP to give you an address.

You could also update to IPv6.

TZubiri

4 days ago

>You're a hospital.

I work for the hospital, occasionally, they are my client.

> You have an actual contract with the ISP, right?

They do not, it's an implied consumer contract, like when someone buys a hot dog from a stand.

I'd like a written contract too, but when trying to negotiate one, they want a lot more money for them, it depends of the nuances of the terms, but I've talked to sales reps, and it comes down to having a 1Gbps line that works right now vs a 100Mbps line that's more expensive, with the only difference being that the contract is now written and there's a symbolic SLA with some 10% penalty, and a single professional beration receiver instead of multiple anonymous on call rotation.

It's not a clear choice, especially considering that the dedicated route with SLA means introducing change risk to the operational and SLA benefit of the ISP, fiber, new holes, new lines, etc..

>You could also update to IPv6.

I would, they don't offer IPv6

>You don't need an address block from an RIR. You just need your ISP to give you an address.

Yeah, maybe. If I get an IPv4 block though what I'd do is a regional entity whether for profit or NFP to offer emergency regional tunneling, potentially while finding alternative revenue streams like collecting lists of wronged ISP customers and notifying them of class action lawsuits they may participate in. A 25K check, or a 5K check with an ipv4 block and I'm golden.

cowlevel

3 days ago

In fact as an IT service provider you should try to get an ISP to give you a contract to provide internet to all your customers as needed.

cowlevel

4 days ago

Well if your hospital is running on the cheapest possible internet made for houses, then you have no rights. You should GET a contract that includes what you actually need.

TZubiri

3 days ago

Service was marketed to corporations, (FiberCorp, business branch of FiberTel)

Also, in technical terms the tech is the same, the internet connects corporations with consumers so it's not surprising that the connective tissue is homogeneous, and there is no strict protocol asymmetry (unless you posit that there's an upload/download semantic association with upload producers and download consumers) so if there's any difference between an consumer and a corporate connection, it comes down to raw traffic volume, which in this case is 1Gbps, which both theoretically and empirically has been fine for years.

cowlevel

2 days ago

Actually, the difference is how much the ISP gives a shit about you. On a residential connection, they do not.

arctic-soda

4 days ago

Email sent!

timvdalen

4 days ago

Good to see the Dutch were able to seize a lot of blocks from the sea!

teekert

4 days ago

It's what we do ;). I'll never forget my visit to the Delta Werken, 35 years ago? Remove our dikes, boom, half the country gone.

Anyway, the Netherlands also seems to be an attractive place to build datacenters.

wmchen

4 days ago

One thing that was always a curious anomaly for me is Brazil having the second largest number of autonomous systems (ASNs) in the world. [1]

MisterMunchkin

4 days ago

I still think we should just extend the length of IPv4. In my proposed system, existing addresses would become a subnet of the new set.

Eg 192.168.0.1 becomes 0.0.0.0.192.168.0.1

And then we dish out all the new address space. You would get the network providers to handle address conversion until software and hardware has been updated. Because all the existing addresses are reserved in the new set, it doesn’t affect them.

Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.

mort96

4 days ago

> backwards compatible with existing hardware/software

Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long. They expect packets to have a 4 byte source address at offset 12 in the header, then a 4 byte destination address at offset 16. Everything breaks if you try to give them a header with an 8 byte source address at offset 12 and an 8 byte destination address at offset 20.

throw0101c

4 days ago

> Absolutely not. Existing IPv4 hardware and software expects addresses to be 4 bytes long.

As does DNS.

"A" records are fixed at 32 bits, so you have to add a new record type and update all DNS software, plus user-space API/library code and data structures to ask for and store the new record type.

Just like IPv6.

There is no "just" adding more addresses: whatever scheme anyone comes up with is the same amount of work as IPv6.

* https://github.com/becarpenter/misc/blob/main/why6why.md

malfist

4 days ago

For every complex and difficult problem, someone has an easy, simple and wrong solution. Usually the presence of "just" is a good clue.

3 days ago

> Thanks for explaining.

No worries, I'm happy to have very slightly reduced the amount of confusion in the world (especially if it might have been caused by my previous message not being as clear as I thought it was at the time of writing!).

georgyo

4 days ago

This is all the bad parts of ipv6 with none of the good parts...

You still need to have routers, clients, and absolutely everything to understand the new scheme to use those new addresses.

charlieyu1

4 days ago

Not using hex is a plus I guess?

growse

4 days ago

You're welcome to not use hex. For either addressing scheme.

charlieyu1

4 days ago

IPv6 is 16 bytes, the person I replied to gives a 8 bytes scheme

dspillett

4 days ago

However many bytes are used in the scheme, you could in theory use decimal or hexadecimal to represent an address in string form for either scheme. Once the string is unpacked and interpreted, the address is just a number.

Though I've never seen a v6 address represented that way, it would make then noticeably longer, so I don't know if anything will accept such a string as a valid address. Though IPv4-mapped addresses are sometimes show as a mix (::ffff:10.5.2.1 for 10.5.2.1) so maybe I'm wrong there.

Likewise I've never seen IPv4 addresses written in hex in the wild, but the relevant specs say it is valid. `ping 0xc0a82bc2` works just as well as `ping 192.168.43.194` but I doubt many forms accepting IPv4 addresses will validate that and allow it.

drawkcabdaernac

3 days ago

I have a script that does takes an IPv6 address and displays it as dotted decimal that I like to bring out any time this discussion pops up. As an example, Facebook's IP address:

  $ ./ipv6todecimal.py 2a03:2880:f366:1:face:b00c:0:25de
  Your IPv6 Address is: 42.3.40.128.243.102.0.1.250.206.176.12.0.0.37.222

Or good old 2600::

  $ ./ipv6todecimal.py 2600::
  Your IPv6 Address is: 38.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0

bottled_poe

4 days ago

And vice-versa for decimal on ipv6 if desired, I guess?

throw0101c

4 days ago

> And vice-versa for decimal on ipv6 if desired, I guess?

Or octal:

* https://networkingtoolbox.net/ip-address-convertor/represent...

bluGill

4 days ago

Computers use binary. Hex is a human convenience. For anyone in computers hex is much better than decimal for obvious reasons. For anybody not in computers hex makes no sense and I'd need weeks of math lectures (which they wouldn't do the homework for and thus fail) to explain it.

Sharlin

4 days ago

Honestly IPv4 addresses should always have been formatted in hex, like FF 00 00 69, with whatever delimiter. Would make it trivial to write directly as a 32-bit int, and parsing and formatting a string would also be cheaper. And you could have funny blocks like CAFE.0.0.

WorldMaker

4 days ago

You can indeed make good use of those funny names in IPv6. If your /64 or /56 prefix is $prefix you can assign your coffee pot to $prefix::cafe or maybe keep it just fe80::cafe if you only want link local access to your coffee pot.

4 days ago

That isn't the hardest part. We already got software and hardware supporting IPv6, and yet...

orangeboats

4 days ago

It still is. A lot of IoT and "smart" devices are still dreadfully slow in updating their software.

preisschild

4 days ago

Tbf there are always bad implementations. Good "smart" devices nowadays should be based on the Matter standard, which natively uses IPv6 addressing

https://en.wikipedia.org/wiki/Matter_(standard)

mahboi

4 days ago

Iot isn't what's holding ipv6 back. There are tons of websites and even cloud platforms with totally ipv6-capable hardware and OSes, but the services are v4-only or strongly v4-preferred.

orangeboats

4 days ago

IoT was an example, a glaring one at that.

IPv6-lacking hardware and software definitely do exist in the wild, have you seen how some programs from incompetent developers accept only IPv4 addresses in the config files? I think all of us have seen at least one such program.

Often times it's just a matter of using another function to parse the address string. But you are shit outta luck if the program is closed source.

mahboi

You'd think that, but for the last decade there's been a huge push to move all the SCADA software into the cloud. "Run your plant from your phone!"

And that's not even counting the various integrators that just don't implement any kind of security at all.

I fight against this sort of thing all the time. Sometimes I get my way.

icedchai

4 days ago

This seems achievable if you can figure out how to fit 64-bits into 32. ;)

_blk

4 days ago

You just drop the top half. Or xor it? That'd make for some nice traffic-pattern art ;)

Now the reason this doesn't work is that the address length is not encoded, so if you make the address longer, no one knows about it and they [routers and destinations] just assume the wrong address and send it on or discard the frame

zeroq

4 days ago

Kids these days can fit 64-bits into a 3-bit hole, and if you squint hard enough it still sounds like a robot. Amazing times, I tell you.

vrighter

4 days ago

just put it in the square hole!

4 days ago

You don't need 192.168.0.0.0.0.0.1. 40 bits covers the world easily, like 1.2.3.4.5. This doesn't mean the field has to be only 40 bits, could be 128 and you don't write the trailing 0s. Of course this means no SLAAC.

But I don't get why the other commenter was proposing putting the 0s at the beginning instead of the end. Shouldn't the new address space be under the existing subnets?

wpm

4 days ago

throw0101c

4 days ago

> I can read one at a glance and the other makes me fill in the blanks myself after having to count how many invisible blanks I need to fill in.

The protocol chosen for IPng, SIPP, did actually have "only" 64 bits, but this was deemed not enough as folks did not want to have to worry about running out again (amongst other reasons), and so tweaked it to have a fixed 128 bits:

* https://datatracker.ietf.org/doc/html/rfc1752

SIPP originally was variable-length capable, but it was decided fixed-length was better (e.g., for hardware like ASICs).

> Wouldn't have been a problem if they hadn't given every square millimeter of the planet 100 billion addresses.

For the record: IPv6 gives 10¹⁷ addresses per mm²; in terms of volume, 10⁸ IPv6 addresses per mm³ throughout the Earth.

wpm

4 days ago

You're right, my 100B per square millimeter undershot by six orders of magnitude.

* https://github.com/becarpenter/misc/blob/main/why6why.md

* https://datatracker.ietf.org/doc/html/rfc1671

> Keeps all the nice parts of IPv4, doesn’t require everyone to switch to an entirely new system, backwards compatible with existing hardware/software. Problem solved.

You have to ship new code to every 'network element' to support your "IPv4+" plan. Just like with IPv6.

You need to update socket APIs to hold new data structures for longer addresses so your app can tell the kernel to send packets to the new addresses. Just like with IPv6. In any 'address extension' plan the legacy code cannot use the new address space; you have to:

4 days ago

Not really. My home IP is 71.177.17.171, how do I get an equivalent v6 that gets routed directly to me? NAT64 and 6to4 don't do this.

Dagger2

4 days ago

4 days ago

introducing asland, the mythical lion daemon.

not really sure what it does, resurrect itself when dead?

(Fun fact: Aslan is canonically Jesus)

dogscatstrees

4 days ago

The scrolling scaling-controller on the map is genius. I wish more maps would add this dynamic ability to scale the logical size when there is a considerable ratio delta to the land size.

oakchris1955

4 days ago

Either I've lost it, or there are other countries there that are bigger losers than the DRC. North Korea says it is 1069.6 times smaller, Greenland says it is 1507.8 times smaller, etc.

blaze33

4 days ago

> Tables include countries with at least 100,000 IPv4 addresses and 20,000 km² of land.

mschuster91

4 days ago

Most consumer ISPs regularly rotate the prefix. IPv6 has proper support for that and can keep connections on the old and new prefix alive for a while in parallel.

With IPv4 most ISPs only rotate IPs on new connections (router restart). But my old home internet even stayed on the same ipv4 for years. Only if I shut down the router for a longer time it got a fresh ipv4 assigned.

So it's an implementation detail, not a technical limitation. Not rotating the prefix is a bad implementation.

zamadatix

4 days ago

Hopefully you mean a static prefix, a static address would be an abomination from an ISP in IPv6!

TZubiri

4 days ago

> https://xkcd.com/1172/

Here I am complaining that I lose my static address, but your problem is that the address is static!

Bottom line is that once a system is a certain way for a while, other systems and people grow dependency on that

>https://en.wikipedia.org/wiki/The_purpose_of_a_system_is_wha...